What does HTTPS provide over plain HTTP?

1. HTTPS = HTTP over TLS (Transport Layer Security). 2. TLS provides three security properties: • CONFIDENTIALITY: data encrypted in transit (no eavesdropping). • INTEGRITY: cryptographic MAC ensures data wasn't modified in transit. • SERVER AUTHENTICATION: certificate chain proves you're talking to the legit server (mitigates MITM attacks). 3. Modern TLS versions: TLS 1.2 (acceptable), TLS 1.3 (preferred). Older SSL/TLS versions are insecure and deprecated. 4. Cert authority hierarchy: CAs (Let's Encrypt, DigiCert) issue certificates after verifying domain ownership. 5. OWASP and NIST require HTTPS EVERYWHERE for any user-facing application. _Source: NIST SP 800-52 + OWASP Top 10 2021 A02 (Cryptographic Failures) — recommends HTTPS._