Secure Web Use
Browsing without becoming a victim
Secure web use is mostly about recognising deception and limiting exposure.
Concepts to know
- Phishing: fraudulent messages that push you to a fake site to harvest credentials. Spear phishing is targeted at a specific person; whaling targets executives.
- URL reading: the real domain sits immediately before the first single slash, and the scheme (https) and subdomain can be faked to look convincing. Read right to left from the slash.
- Padlock/HTTPS: confirms encryption, not legitimacy.
- Cookies: small files storing session data; third-party tracking cookies raise privacy concerns, and session cookies should not be shared.
- Pop-ups and drive-by downloads: malicious sites can attempt automatic downloads; keep the browser patched and block pop-ups.
- Certificate warnings: a browser warning about an invalid certificate means the connection cannot be trusted; do not proceed on a banking or login page.
Traps
- "The email came from a colleague's address, so it is safe" - accounts get compromised.
- "The site has a padlock, so it is genuine" - false, as above.
- A link whose visible text says a bank but whose underlying address points elsewhere; hover or long-press to reveal the real target.
- Urgency and threats ("account closes in 24 hours") are pressure tactics, not proof.
Rule of thumb: never log in from a link in an unsolicited message. Navigate to the site yourself by typing the known address.
Worked example: An email says your parcel is held and links to https://delivery-track.secure.example-login.info. The padlock is present, but the registered domain is example-login.info, unrelated to any courier - a phishing site. The safe action is to close it and visit the courier's official site directly.