The padlock, the VPN and the private window

Take the drawing you made in lesson 7, the second one, the one with the parties in it. You are going to need it, and this lesson is going to ask you to mark it up rather than draw it again.

Most people's three rows come out looking very different from one another. When you see the filled-in version later on, the striking thing is how much of it is the same words repeated, and the handful of boxes that do differ are the only places any of these tools does anything at all.

Three tools, and one question to ask all of them

The padlock, the private window and the VPN are the three security tools an ordinary person is most likely to have an opinion about. They are also the three most often used against a problem they do not touch.

First, three words, because lesson 1 promised you this lesson would say what they mean and lessons 2 to 7 haven't.

Encryption is scrambling something so that only the intended reader can unscramble it. Anyone carrying it in between sees the scrambled version and can do nothing with it.

HTTPS is the web's own way of asking for and sending pages, with encryption on top. The s is the encryption, and the padlock, where your browser still shows one, is the sign that it's in use.

A cookie is a small note a site asks your browser to keep and hand back on the next visit. It's how a site knows you're the same visitor as last week, and it's what keeps you signed in.

Now, the thing the three tools have in common, and it's the whole lesson. Each of them acts at exactly one point on the path you drew in lesson 7. Not at all of it, not at "the internet", at one point. Every misconception in this lesson, including the measured ones with numbers attached, is somebody applying a tool at a point it doesn't reach.

So there is one question to ask of each tool, and you already have the diagram to ask it against:

Which party on the path does this change something for, and which parties does it leave exactly as they were?

Three bars, three different lengths, and each one covers exactly the parties that tool changes something for.

The private window is the short one. It covers your device and stops there, because your device is all it is about.

HTTPS covers the three parties in the middle. It stops short of the branch, because the name lookup finished before the connection opened and is not inside it, and it stops short of the far end, because the two ends of an encrypted connection are the two parties who can read it.

The VPN covers the branch and the middle, and then there is a party at the foot of it that was not on lesson 7's path at all. That party is the whole of the VPN section below, and it is the part the advertising tends to leave out.

Now take the three in turn.

What the padlock certifies

When you see the padlock, one thing has been established: the connection between your device and whatever domain is in the address bar is encrypted. That is it. That is the whole claim.

Work through the path with that in hand.

Your router, your provider and the networks in between now carry traffic they cannot read. They can still tell that you connected, when, and how much.

What they can tell about where is not the same for all three, and lesson 7 settled it. Your router and your provider can name the domain, because on most home connections your provider answered the name lookup as well. The networks in between are where lesson 7 left them: an address, and one address at a delivery network answers for thousands of sites. They cannot tell what you asked for or what came back.

The name lookup is untouched, because it happened before the connection opened and it is not inside it. Whoever answered your names still knows which names you asked for.

The delivery network and the service can read everything, because they are the far end. Encryption between two parties is not a secret from either of them.

So HTTPS changed what the middle can read, and it changed nothing whatever about who the ends are.

Which is why the padlock is finished as a safety signal

The certificates behind phishing padlocks are domain-validated ones, and that is the term the research uses.¹ What domain validation means is that something proved control of the domain name. Not that a company exists, not that it's the company it says it is, not that it's honest. It proved it controls example.com, and it got a certificate for example.com.

There are stricter kinds, which check more, and this course hasn't researched how common they are. It doesn't need to, because the point stands either way: the padlock looks identical whichever kind is behind it, so it can't be the thing you read.

Anybody who registers a domain controls it. Including somebody who registers secure-barclays-login.com this morning.

The numbers are exactly as bad as that suggests. The Anti-Phishing Working Group's quarterly reports carry a series contributed by PhishLabs on this, and the report for the second quarter of 2021 says in its own words: "After peaking in late 2020, the percentage of phishing sites protected by SSL dropped to 82 percent in 2Q 2021."¹ Eighty-two percent, in the quarter where it had fallen. A second contributor to the same report, Axur, put its own regional figure at 70 percent against that 82 worldwide.

And the finding in the same report that actually explains the world is this one: 90 percent of the certificates used in phishing were free, domain-validated certificates.¹

That is the mechanism. The 90% is the part to hold on to. Whatever a padlock once cost in money or effort, the certificates behind nine in ten phishing sites that quarter were free ones, available to anybody, including the person building a copy of your bank. A signal anybody can produce for nothing can't tell you who they are.

"But my browser does not show a padlock any more." Go and look at your own address bar rather than take anybody's word for it, including this lesson's. What browsers display here has been changing, and the direction of the change is away from a mark that says the connection is fine and towards a warning that appears only when it is not. That is the useful half of the signal. The absence of a warning still tells you about the connection and still tells you nothing whatever about who owns the site, which is the point of this section either way. This course has not researched which browser changed what, or when, so treat the paragraph as a reason to go and look rather than as a fact to remember.

What a private window does

A private window, incognito, InPrivate, whatever your browser calls it, is the tool with the widest gap between what it does and what people think it does. That gap has been measured, and the measurement is the reason this section exists.

What it does: when you close the window, that browser does not keep the session's history, cookies or form data on that device. That is the claim, and it is true.

Where it acts: the gold dot. Your device. It is a statement about your own disk.

What it does not touch: the site you visited, which sees the same visit it would have seen; your internet provider, which carries the same traffic; your employer's network, if you're on it; an advertiser, who identifies you by a good deal more than one cookie; and malware, which it has no relationship with at all.

Now the measurement. Habib and seven colleagues published a study in 2018 that did two things at once. It instrumented three years of real browsing from 451 participants, 167,128 sessions in total. And it surveyed 532 people against fourteen true-or-false statements about private browsing, drawn from two quite different places: 305 from an online task marketplace, and 227 from that same group of observed browsers. Where two numbers appear below, the online panel comes first and the observed browsers second.²

The behaviour first, because it is not what people assume. Private browsing occurred in 4% of observed sessions. Among those participants, 41% used it at least once. And the commonest activity inside a private session was not the one everybody jokes about: logging into a service accounted for 38% of private sessions, general browsing 37%, searches 33%, and adult content 24%. Adult content was the dominant reason for only 18% of users, and 22% of users had no dominant use at all.

Now the beliefs. These are from the paper's Table 6, and they are stated as the percentage of people who use private browsing who answered a false statement correctly. So the rest either believed it or did not know.

• "Private browsing prevents my browser from sending any cookies to websites": 24% and 26% correct. 22% of both actively believed it.
• "Private browsing clears all my browsing history from my computer after I close the window": 27% and 42% correct.
• "Private browsing allows me to browse the web anonymously": 51% and 52% correct, with the paper reporting 39% of both populations answering it incorrectly.
• "Private browsing causes the information I send to websites to be encrypted": 55% and 50% correct.
• "Private browsing does not allow my internet provider to see which websites I visited": 66% and 69% correct, and among people who don't use private browsing at all, only 38% and 33%.

Read the first one again. About a quarter of the people using this feature could correctly say what it does about cookies. These are users, not bystanders.

And then the one that matters most, because it is the only one on the list with a physical consequence:

5% of the online panel, and 12% of the observed browsers, expected private browsing to protect them from malware and hacking.²

That is somebody opening a suspicious attachment in a private window because they believe the window is a container. It is not a container. A file downloaded in a private window lands on the disk exactly like any other file, and a page that attacks the browser attacks the same browser.

The authors also note that browsers' own private-mode landing pages, the paragraph you see when you open the window, do little to correct any of this.² Which means a lesson that simply repeats the landing page has failed before it started, and it is why this one gives you the diagram instead.

What a consumer VPN does

A VPN builds an encrypted tunnel from your device to a company's server, and your traffic comes out of that company's server and goes on to its destination.

Follow what that does to the path.

Your router and your internet provider, and a café's network if you are in a café, now see one thing: an encrypted connection to the VPN company. They stop seeing which sites you reached, because the destinations are inside the tunnel. Your name lookups ordinarily go through the tunnel as well, which is why the oxblood bar in the figure covers the branch that the navy one doesn't. (That last detail is how these products are normally built rather than something this course has researched, so if it matters to you, check what your own one says it does.)

Then the tunnel ends, and this is the part the advertising tends to leave out. The VPN company now sees everything your provider used to see. Which sites, when, how often, from an account you paid for with a card in your name. You have not removed a party from the path. You have swapped one for another and chosen which one it is.

That is not nothing. Choosing is worth something, and there are three purposes where it is the right tool:

• An untrusted local network. A café, a hotel, an airport. You do not know who runs it and a VPN means you do not need to.
• Keeping a destination from your internet provider, if that is a worry you can actually name.
• Changing your apparent country, which is a real capability with real uses.

And there is a long list of things it does not do, all of them things people buy it for: it does not make you anonymous to a service you sign in to, it does not stop advertisers identifying you, it does not stop phishing, and it does not stop malware.

How the marketing measured up when somebody checked

In December 2021, Consumer Reports' Digital Lab published an evaluation of consumer VPNs done with a team from the University of Michigan.³ They screened 51 VPN services on Windows 10 and evaluated 16 of them in depth.

The findings, all of them from that 2021 evaluation and all of them counts rather than rates:

• 12 of the 16 either inaccurately represented their products or made hyperbolic or overly broad claims.
• 8 of 16 had current third-party security audits of the core product.
• 6 of 16 had reproducible builds.
• 4 of 16 mentioned internal audits.
• One was still shipping PPTP, a protocol from the 1990s.

Four of the sixteen described their own limits accurately, and they are worth naming because the point of a count like this is that it is not a verdict on an industry: Mullvad, IVPN, Mozilla VPN and TunnelBear.³

The report also picks out a phrase, and it is worth carrying with you: "military-grade encryption" is treated as a red flag by security professionals because it does not mean anything. There is no such grade. Whatever encryption sits behind the phrase, HTTPS is already scrambling the contents between you and the site, for nothing. What a tunnel adds isn't stronger scrambling. It's hiding the destination from your provider, and that's a different job. And the report makes the broader point plainly: advertisers and governments identify people by a great many means that have nothing to do with the address a VPN changes.

None of that is a verdict on an industry, and it shouldn't be read as one. Sixteen products were looked at closely in 2021, twelve described themselves inaccurately or too broadly, and four described their limits accurately. What it does say is that the promise the category is usually sold on is anonymity, and anonymity isn't the thing the tool provides.

A VPN is a good answer to a small, nameable question. It's a bad answer to "I want to be private", and the reason is that the sentence never says private from whom.

The two worked cases

One session, three ways

Your table from the start of the lesson, filled in.

Four rows, and look at how much of the table is the word "same".

Count the boxes that differ from the ordinary column and you get five out of eight. Which five is the lesson.

The private window changes two, and both are about your own machine: what is left on the laptop, and whether the site is handed a cookie from the last time you were there. That is the whole of its reach.

The VPN changes three, and all three are one fact restated: your provider, your employer's network and the site itself. Each of them used to see where you went or where you came from, and now each of them sees the VPN company instead.

So two tools and two ideas between them. One is about your disk. The other is about who sees the destination on the first stretch.

And nothing in any column changed what you read, in any row. That was HTTPS the whole time, working identically in all three.

Everything else in the table is HTTPS, which was already working in all three columns and is why "what you read" appears in none of them.

A phishing site with a perfect padlock

Now the case that makes the whole lesson matter.

A message arrives about a payment that did not go through. The link goes to secure-barclays-login.com. The page is a pixel-perfect copy of the bank. The certificate is valid. The padlock is there, closed, unremarkable. The connection is properly encrypted.

Every technical signal the folklore names is present and correct.

Work through what each tool did:

HTTPS worked perfectly. It encrypted the connection between the reader and secure-barclays-login.com, so nobody in the middle could read the password as it went past. It delivered the password to the attacker in a condition of excellent confidentiality.

A private window would have changed nothing, except that the attacker's cookie would not have been kept afterwards, which is no comfort at all once the password has gone.

A VPN would have changed nothing, except that the attacker would have seen the connection arriving from the VPN company's address rather than the reader's own.

Three tools, all working exactly as designed, and none of them touches this. What would have caught it is reading the domain backwards from the single slash, past the ending and one word further, which gives secure-barclays-login.com, and that isn't the bank.

Lesson 11 is about the shape of that message and about what to do in the ten minutes after you have clicked. This is the technical half of it, and the reason it belongs here rather than there is that the padlock is the specific thing that made the page convincing.

What people get wrong

"The padlock means the site is safe." It means the connection to that domain is encrypted. In the second quarter of 2021, 82% of phishing sites had one, and 90% of the certificates behind them were free.¹ The padlock and the danger are not in tension; they never were measuring the same thing.

"HTTP sites are the dangerous ones." This was once a rough and useful rule, because a site that could not be bothered with a certificate was often a site that could not be bothered with anything. It stopped being useful when certificates became free and automatic, which is the same change that put a padlock on four phishing sites in five. Saying when a rule stopped working is better than either repeating it or banning it.

"Incognito hides me." From your own device's history, yes. From the site, your provider, your employer's network and an advertiser, no. 39% of both populations in the 2018 study answered incorrectly when asked whether it made them anonymous.²

"Incognito protects me from viruses." This is the one with a consequence, held by 5% of one of the 2018 study's two populations and 12% of the other.² A private window is not a sandbox, not a virtual machine and not an antivirus. A file you download in it is a file on your computer.

"A VPN makes me anonymous." It moves which company can see your destinations. If you sign in to something, you have told that something exactly who you are, from inside the tunnel, and the tunnel has no opinion about it.

"Military-grade encryption." Not a thing. Consumer Reports' 2021 evaluation names it as a red flag precisely because it means nothing, and a product page that leans on it is telling you something about its marketing rather than its cryptography.³

"These tools stack up, so using all three makes me pretty safe." Three tools that act at three different points do not compound into general safety, because the gaps between them are not covered by any of them. Look again at the figure: nothing in it touches your password, your accounts, the software you install, or a message that persuades you to do something. Those are lessons 9, 10 and 11, and they are where most of what actually happens to people lives.

Practice

Connections

Lesson 7 gave you the path, and this is the first thing you've done with it. Every claim above was checked against the figure rather than against an intuition, which is a habit worth carrying into lessons 9 to 13, because all five of them hang off the same drawing.

Lesson 1 gave you the security plan, and the first exercise above is the first time it has been tested. The number of lines that came back "none" is the honest measure of what these three tools are for.

Lesson 9 is about installing software, which is the question of what you are trusting when something arrives on your machine. Notice that none of the three bars in the figure goes anywhere near it.

Lesson 11 is about recognising a con, and it inherits the padlocked phishing site above as its best example. The reading habit from the predict block, finding the first single slash and reading leftwards past the ending, is the one thing from this lesson you should be able to do in your sleep.

Lesson 13 asks what services keep about you. The parties this lesson could not hide you from are the ones that lesson is about.

Go deeper

• Habib and colleagues, "Away From Prying Eyes: Analyzing Usage and Understanding of Private Browsing" (2018), free from the symposium. Table 6 is the one to look at. Read it for how the questions were worded, because half the interest is in how carefully a true-or-false statement has to be written before an answer means anything.
• The APWG's quarterly Phishing Activity Trends Report, free, one PDF a quarter. This is the 2021 one the padlock figures come from. Read it for the shape of the thing rather than the totals: it is a count of attacks by sector and by target, published four times a year, and watching one number move across four quarters teaches more about the subject than any single quarter's figure.
• Consumer Reports' 2021 evaluation of VPN services, done with the University of Michigan. Worth finding and reading in full if you are actually considering buying one, because the per-product detail is the useful part and this lesson only has the counts. This course's research file records no link for it, so search for it by name rather than trusting a link from anywhere, which is advice this lesson has earned the right to give.

Sources

1. Anti-Phishing Working Group, Phishing Activity Trends Report, 2nd Quarter 2021. The section contributed by PhishLabs was opened and read. Supplies the quoted sentence about the percentage of phishing sites protected by SSL dropping to 82 percent in 2Q 2021, which is verbatim; the finding that 90 percent of certificates used in phishing that quarter were free domain-validated certificates; and Axur's separate regional figure of 70 percent against 82 worldwide. An earlier draft of this course's research recorded "over 90% by 2023" from a search summary. That figure does not appear anywhere in the quarterly series and is not printed in this lesson; the correction is recorded in research/SOURCES.md. The rest of the APWG series is read at search-summary level only and nothing else from it is used here.
2. Hana Habib, Jessica Colnago, Vidya Gopalakrishnan, Sarah Pearman, Jeremy Thomas, Alessandro Acquisti, Nicolas Christin and Lorrie Faith Cranor, "Away From Prying Eyes: Analyzing Usage and Understanding of Private Browsing", Symposium on Usable Privacy and Security, 2018, pages 159 to 169. Read in full, including Tables 3, 5 and 6. Supplies the two data sources (three years of instrumented browsing from 451 participants over 167,128 sessions, and a survey of 305 and 227 participants against fourteen true-or-false statements); the 4% of sessions and 41% of participants; the breakdown of what private sessions are used for; every percentage in the beliefs list, which are the shares of private-browsing users answering each false statement correctly; the 39% of both populations answering the anonymity statement incorrectly; the 12% and 5% expecting protection from malware and hacking; and the authors' observation about browsers' own private-mode landing pages. One note on the author list, because the build's citation check works on surnames and this is the first case in the repo to need it. One of these authors also co-wrote a paper on password managers that this course read only at summary level and did not open, so that surname sits in research/SOURCES.md's unread: line. The line carries an exemption for this lesson, written Pearman (except 08), and the entries on both sides say which work is which. This paper was read in full and is cited in full.
3. Consumer Reports Digital Lab, evaluation of consumer VPN services, published December 2021, with a team from the University of Michigan. Read in full. Supplies the screening of 51 services on Windows 10 and the 16 evaluated in depth; the counts of 12 of 16 inaccurately representing their products or making hyperbolic or overly broad claims, 8 of 16 with current third-party audits of the core product, 6 with reproducible builds, 4 mentioning internal audits, and one shipping 1990s-era PPTP; the naming of Mullvad, IVPN, Mozilla VPN and TunnelBear as the four that described their limits accurately; the treatment of "military-grade encryption" as a meaningless phrase and a red flag; and the point that advertisers and governments identify people by means unrelated to the IP address a VPN changes. A 2025 conference paper on VPN providers' threat claims was identified during research and not opened, so nothing here rests on it.
4. Ruogu Kang, Laura Dabbish, Nathaniel Fruchter and Sara Kiesler, "'My Data Just Goes Everywhere': User Mental Models of the Internet and Implications for Privacy and Security", Symposium on Usable Privacy and Security, 2015. Read in full. Not cited in the body of this lesson, and listed because lesson 7's path, which this lesson marks up throughout, is built on it.