Browsing the internet safely

Which habits actually work, and in what order?

First of all: keep the browser updated. That sentence has been repeated so often that it is no longer heard, but repetition does not change the order of importance. Almost every hole that reaches your device merely by opening a page is a hole in the browser itself, and its patch shipped weeks before you heard about it. A browser three versions behind is more exposed than any security setting you can put on top of it.

The real order, by what each habit actually stops, is this: update the browser and the operating system; cut down the extensions; be careful with downloaded files; use a different password for accounts that matter; and last of all, the thing most talked about, looking at the padlock and at the address.

Two things that are not on the list and feel like they should be. First, clearing history regularly: it is not a bad habit, but it is not security, it is privacy, and it has its place in the privacy lesson. Second, installing an extra security tool into the browser: most of them are themselves an extension, and the third section of this lesson is about extensions.

Our position: if you are going to do exactly one thing, turn automatic updates on and leave them alone. If two, delete the extensions you have not opened in a year. The rest of the list is smaller than those two.

What does the padlock beside the address bar prove?

One thing, and only that one thing: your connection to that domain is encrypted and nobody in the middle can read it or change it. About who sits behind that domain and whether they are telling the truth it says nothing, and it was never meant to. The technical detail is in the lesson on HTTP and HTTPS.

The issuers say the same thing themselves. Let's Encrypt, whose free certificates sit on millions of sites, wrote in its own explanation that a domain validation certificate asserts only that a public key belongs to a domain and "says nothing else about a site's content or who runs it", and adds plainly that such a certificate carries no information about a website's reputation, real-world identity or safety.

The certificate of the very site you are reading is a good specimen. Open it, and the subject field holds exactly one thing: the domain name. No company name, no registration number, no country. Precisely what a fraudulent site can also obtain in a few minutes at no cost at all.

And a real specimen from this site own contact form, on the day this lesson was being written: a message arrived pushing the reader towards a page about a Bitcoin transfer. That page was hosted on a completely legitimate and well known text publishing service, with sound HTTPS, a green padlock, and a domain name nobody would suspect. None of the old tells applied. What gave the message away was something else entirely: a cryptocurrency transfer nobody had asked for, arriving through a form meant for web design enquiries.

So what is the right tell? Not the padlock, but coherence. Is this message the answer to something you started? Is the domain in the address bar the place you think you are, letter by letter? Does what is being asked of you match what that site actually does? If all three are yes, the padlock is a bonus. If not, the padlock rescues nothing.

Why is a browser extension the most overlooked risk?

Our position, said plainly: a browser extension has the widest gap between how risky it is and how much attention it gets. Most people think for an hour before installing an app and install an extension in two seconds, while the extension sits in the one place their entire online life passes through.

The reason is written in the permissions line and almost nobody reads it. A sentence like "read and change all your data on all websites" means exactly what it says: that extension can see the contents of your bank page, can read what you type, and can change the page so that you do not notice. Google own documentation for extension authors classifies permissions with exactly this bluntness, and Mozilla has a page saying what each permission request message actually means.

The second problem, and it is the worse one: extensions change hands. A simple, harmless extension that has grown popular over a few years can be sold, and the new owner can add whatever they like in the next version. You trusted something that is itself able to change, and automatic updates deliver that change to your device without a sound.

We live the same thing at a different scale on our own server. This site runs twenty four active WordPress plugins, and each of them, exactly like a browser extension, executes with the same authority WordPress itself has. That is why we keep the count down, why we wrote most of them ourselves, and why a plugin whose job is finished stays deactivated rather than left on just in case. The rule is the same in both places: less code, less attack surface.

The practical move: open your browser extensions page, delete anything you have not opened in a year, and read the permissions column for the rest. A unit converter does not need to read and change data on all websites.

How do you tell what a file you downloaded really is?

Not from its extension. We say that not from an article but from our own code. Our upload layer looks at the file extension first, but does not stop there: it then reads the real content of the file and rejects it if the content does not match the extension, and the message the user sees says exactly that. For images it goes one step further and tries to actually open the file as an image; a file with a picture extension that is not a picture is caught precisely here.

The reason is simple: a file extension is a claim by whoever named the file, not a fact about its contents. Windows also hides known extensions by default, and that one setting is what displays a file called "invoice.pdf.exe" on your screen as "invoice.pdf".

Four habits with the most effect. First, turn on the display of file extensions in Windows settings; once, forever. Second, take software from the maker own site rather than the first search result, because the adverts above the results are exactly where poisoned builds sit. Third, be suspicious of a file you were not looking for that arrived on its own; email attachments and files sent in messengers are the main route malware takes to an ordinary user. Fourth, when the operating system warns you as you open a file, take that warning seriously; getting past it needs one more click, and that click was put there deliberately.

Installing safely and checking that a file is what it claims has a lesson of its own: installing software safely.

Is public wifi still dangerous?

Far less than it was ten years ago, and less than what is still written about it. That old picture, somebody sitting in a cafe plucking your banking password out of the air, was built on a world where most sites had no encryption. Today nearly everything you open is encrypted and that attack no longer works easily.

But "less" is not "none", and what remains usually goes unsaid. The figure below shows the four real layers. The owner of the network still sees which domains you connect to, even when they cannot see the contents; the domain name is still visible in the early stages of the connection and in the name lookup. The page that opens when you join and asks for a password or a phone number is not the internet, it belongs to whoever runs that network. If your browser is out of date, the network you are sitting on is one of the best places to exploit exactly that hole. And the last one has nothing to do with networks: the person standing behind you can see your screen.

So in practice? Four things. Turn off automatic joining of open networks on your phone, because your phone will otherwise attach itself to any network with a familiar name. Turn off file sharing on a public network; Windows asks you this as you connect and most people click past it. If the browser warns you about a site certificate, take it seriously on a public network in particular. And do the things that involve money or identity over your own phone connection rather than the hotel free wifi; not out of fear, but because it costs nothing.

And honestly: for most people the bigger risk is not airport wifi, it is the extension they installed three years ago and forgot.