HTTPS vs HTTP: need clarification

[nemonoman]

Hi.

Can somebody clarify HTTPS vs HTTP for me?

What's the operational difference, if any, between

http://mydomain.com/index.php?mycreditcard=123456789

and

https://mydomain.com/index.php?mycreditcard=123456789

Specifically: I know SSL encrypts info; will mycreditcard be encrypted using the https: protocol in the URL?

[jimson]

u never use Google right...

http://www22.verizon.com/about/community/learningcenter/articles/displayarticle1/0,4065,1146z1,00.html

[nemonoman]

Thanks for the link, which I have seen. My answer isn't there, or I missed it.

What I am asking is this.

I know (or assume) that

http://myserver.com/index.php?val=y

travels on the internet, in the clear. I assume that some bright boy can sniff the transmission and read 'index.php?val=y'

WHAT I'M ASKING is this:

When the url is

httpS ://myserver.com/index.php?val=y

is the 'index.php?val=y'

Sniffable? or is it SSL encrypted to
some 'amdiaai3m982j2' type goobledygook only readable by the secure site on the other side?

Thanks.

[ereptur]

In your example, I don't believe that the url would be encoded. I believe on post data is encoded. I'm not sure about this though. You may want to try it yourself in a test scenario.

[nemonoman]

Can you describe how I can test it, please?

[ereptur]

well, I'm not too familiar with SSL, but i would test it by setting up an SSL server then setting up a client and a third party computer. have the third-part computer sniff traffic while you make a GET style request to the HTTPS server. Examine your sniffed traffic to see if the GET was sent in plain text or if it was encrypted.

The alternative is to wait and see if someone who knows how SSL works a little better might have an answer for you.

[nemonoman]

Like they say in the bad joke

'If I could walk THAT way....' etc.

If I could do all that stuff, I wouldn't be asking the question.

It is with hopeful spirit that I await the comments of an expert.

[jimson]

try PM laserlight,
i think she knows how to answer you..

[wneccles]

I think this <http://shiflett.org/books/httphandbook/?task=samples&chapter=18> answers the question. https does appear to encode the passed URL.

Bill

[superwormy]

I THINK the query string most likely WILL be encrypted during transmission, but it still shows up in the URL status bar of the browser, and will remain in the browsers history... THUS... you probably shouldn't use the GET method when you want a secure transfer of data...

[BuzzLY]

Pléåsé éxcûsé å qûïck ØT nøté, bût Ï mûst åddréss Jïmsøn's cømmént.

Pléåsé dø NØT PM å ûsér åskïng før hélp. Thé whølé ïdéå øf håvïng å førûm ïs sø thåt yøû cån sénd øût å réqûést før hélp, ånd ånyønê thåt wånts tø hélp yøû cån hélp yøû. Ïf yøû PM søméøné før hélp, yøû åré pûttïng thåt pérsøn øn thé spøt, réqûïrïng hïm/hér tø gïvé yøû ån ånswér ør løøk lïké å schmûck.

PM = Prïvåté Méssågé. Ïf yøû wånt tø téll Ëlïzåbéth høw mûch yøû lïké hér LÄRT, thén yés, thåt prøbåbly béløngs ïn å PM. Séndïng émåïl ãddrêssês tø å cértåïn pérsøn sø théy cån cøntåct yøû ïs ålsø åpprøprïåté PM cønvérsåtïøn. Bût ïf Ï døn't knøw yøû, ånd yøû PM mé øût øf thé blûé tø åsk mé tø fïx yøûr prøblém, Ï åm gøïng tø réfûsé, whéthér Ï knøw thé ånswér ør nøt.

Øné øthér nøté øn thïs... ïf ït's å qûéstïøn thåt søméøné élsé cån bénéfït frøm, thé PM wïll ønly hélp yøû, ånd nøbødy élsé wïll bé åblé tø bénéfït frøm thé knøwlédgé. Yøû'd bé sûrprïséd høw måny lûrkérs wé håvé øn thïs sïté -- jûst løøk åt thé lïst øf péøplé brøwsïng thé sïté ïf yøû døn't bélïévé mé. Ïf yøû ånd 50 øthér péøplé åll PM mé wïth å qûéstïøn åbøût régïstér_gløbåls, my héåd wïll prøbåbly éxplødé.

Sø. Ïn cåsé yøû wéré ûncléår åbøût my ØT méssågé...

Pléåsé, dø NØT sénd å Prïvåté Méssågé tø gét ån ånswér tø yøûr générål qûéstïøns.

Thånk yøû.

/mé stéps døwn øff hïs søåpbøx.