What HTTPS Actually Protects (And What It Does Not)

A coffee-shop login reveals the boundary of HTTPS: key agreement, certificates, protected records, phishing, CDN endpoints and the limits of encrypted transport. Tiny packet. Big questions. CHAPTERS 00:00 The coffee shop question 01:06 The handshake 02:22 Checking the name 03:36 Protecting the messages 04:55 Where the envelope ends 06:17 Faster return visits 07:37 Warnings and limits 08:54 The useful mental model TECHNICAL SOURCES RFC 8446 — TLS 1.3, sections 1, 2, 4, 5 and 8: https://www.rfc-editor.org/rfc/rfc844... MDN — Transport Layer Security: https://developer.mozilla.org/en-US/d... Let's Encrypt — How domain validation works: https://letsencrypt.org/how-it-works/ Chromium — An Update on the Lock Icon: https://blog.chromium.org/2023/05/an-... MDN — Secure contexts and transport boundaries: https://developer.mozilla.org/en-US/d... Cloudflare — SSL/TLS concepts, edge and origin certificates: https://developers.cloudflare.com/ssl... RFC 9001 — Using TLS to Secure QUIC: https://www.rfc-editor.org/rfc/rfc900... MDN — Strict-Transport-Security: https://developer.mozilla.org/en-US/d... Original Wumblu animation and script. Narration uses a synthetic AI voice (Qwen CustomVoice). Diagrams are simplified; maps and timings are illustrations, not measurements. #HTTPS #Internet #Wumblu