Article explains the difference between http and https protocols.
The information presented above (which was penned by Douglas Twitchell and posted to his web site in 2007) is generally correct: Accessing a web site through a URL that begins with the https:// protocol identifier indicates that information is being transmitted via Secure HTTP (S-HTTP) or Secure Sockets Layer (SSL), protocols which encrypt information passed between a client (browser) and aserver (web site). It is especially important to ensure a secure protocol is in use on web pages that process functions (such as online purchases and bank transactions) involving the transmission of credit card numbers, account numbers, Social Security numbers, PINs, and other sensitive personal information in order to prevent electronic eavesdroppers from snooping on web activity and thereby gaining access to (unencrypted forms of) such data.Certainly using an unsecure (http://) connection to send sensitive information is a situation best avoided. However, due to proliferation of digital spoofing schemes, a secure (https://) connection is not necessarily an absolute guarantee of safety - when engaging in financial transactions over the Internet, you should still take steps to ensure you are dealing with a reputable entity, and that you are actually connected to a web site operated by the entity you are dealing with (rather than a look-alike site set up as a deception by cybercrooks).A February 2011 alert warned that:While on Facebook, look at your URL address; if you see http: instead of https: then you don't have a secure session and you can be hacked. Go to Account | Account Settings | Account Security and click Change. Check at least the first setting, FB defaults to the non-secure setting.In general, something Facebook users might need to be concerned about is session hijacking (also known as sidejacking), a technique by which malicious users on public networks (such as Wi-Fi hotspots) intercept other people's session cookies to gain unauthorized access to their accounts. Although login passwords are typically encrypted to protect them from being grabbed off a network, session cookies are not always as well protected, making users of public networks who surf sites which do not employ SSL or encrypting protocols vulnerable to snooping programs such as Firesheep:Until recently, only determined and knowledgeable hackers with fancy tools and lots of time on their hands could spy while you used your laptop or smartphone at Wi-Fi hot spots. But a free program called Firesheep has made it simple to see what other users of an unsecured Wi-Fi network are doing and then log on as them at the sites they visited. While the password you initially enter on Web sites like Facebook, Twitter, Flickr, Amazon, eBay and The New York Times is encrypted, the Web browser's cookie, a bit of code that that identifies your computer, your settings on the site or other private information, is often not encrypted. Firesheep grabs that cookie, allowing nosy or malicious users to, in essence, be you on the site and have full access to your account. The only sites that are safe from snoopers are those that employ the cryptographic protocol Transport Layer Security or its predecessor, Secure Sockets Layer, throughout your session. PayPal and many banks do this, but a startling number of sites that people trust to safeguard their privacy do not. You know you are shielded from prying eyes if a little lock appears in the corner of your browser or the Web address starts with 'https' rather than 'http.'(Facebook users should note that some applications may not function properly if the https protocol is enabled.)
nan