TO MANY of his constituents, Charles Schumer, a Democratic senator from New York, appeared to spout gibberish on Sunday. "Major web sites [should] switch to secure HTTPS web addresses instead of the less secure HTTP protocol," he told Reuters in a Manhattan coffee shop. Mr Schumer's statement, however, constitutes perfectly sensible advice—he was well briefed by his staff. Such a move would prevent theft of casual digital identities and personal information in public places—and hinder politically motivated interception by repressive (or democratically elected) governments.

HTTPS is the secured or encrypted form of HTTP (Hypertext Transfer Protocol), a communications language that directs the way in which web browsers and web servers interact to request and retrieve pages, images and other files. HTTPS layers encryption on top of plain HTTP using SSL/TLS (Secure Sockets Layer/Transport Layer Security). These are the old and current names for web-page securing technology that dates back to the world wide web's juvenile days, not long after Netscape alerted the masses to its existence.

Websites that offer SSL/TLS security allow connections via a URL that starts with "https" in the location field or link. First, the browser silently requests security credentials that the server provides. Next, it validates this information independently using either its own built-in data or those included in the operating system. If it passes muster, the browser and server exchange an encryption key, unique to each session, which is then used to guard the data that passes between them. Any whiff of interception or rerouting is enough to alert the user. Because of the way browsers and operating systems validate SSL/TLS certificates, an interloping party (the so-called "man in the middle") cannot pretend to be a secured server (to a browser) or a secured browser (to a server) without provoking such warnings. 

Flaws in earlier versions of SSL/TLS were patched up years ago and it is generally regarded as foolproof—and vital. The risk of not using it was readily demonstrated in the early stages of Tunisia's recent upheaval. The government allegedly intercepted connections between citizens and the unencrypted version of Facebook's local site, as Alexis Madrigal explained on January 24th in the Atlantic. The government could then intercept traffic by pretending to be Facebook; users, unaware, would blithely bung in their credentials, handing over access to their account and their entire social network. (To its credit, Facebook decided to flip on SSL/TLS for all of Tunisia and, later, made it available as an account preference worldwide. The internet company has offered HTTPS for some time but users outside Tunisia still have to opt in.) 

Mr Schumer's statement, and a letter he has sent to large web site operators, comes a decade after free software appeared that made it trivial for the mildly knowledgeable to intercept any data over an open Wi-Fi network, like nearly all of those in cafés or at airports. (Office and home networks protected with some form of password are a different matter.) While corporations typically require employees to use encrypted connections known as a VPN (virtual private network), ordinary users have, by and large, remained oblivious. This lack of concern may stem from the near-univeral use of HTTPS by banking, investment and e-commerce sites to protect logins, transactions and credit-card data. The lock icon which pops up in browsers for such sites may have lulled less tech-savvy types into complacency. But the massive growth in the use of web apps for email and social-networking sites exposed information identity thieves and other scammers relish.

In 2007 software was released which could intercept bits of data used by websites to identify a user from anyone on the same public Wi-Fi network. Session tokens, as these bits are called, are generated after a login, in which a secure connection is used just long enough to allow the entry of a username and password before the web browser is redirected back to an unsecured version of the website. By grabbing hold of these, impostors were able to "sidejack" a Gmail account or other services that his victim had accessed. With access to email, an attacker could visit popular sites, reset a user's password and use email to retrieve login information. Following a flurry of sidejacking activity Google began the process, which ended up taking several years, of tweaking most of its services to provide SSL/TLS as an option (though not a requirement).

A smattering of technical know-how was needed to sidejack—and the sidejacker had to be in close proximity of a sufficient number of users to make it worthwhile. Two developments have changed that equation. First, the release of a proof-of-concept plug-in for the Firefox browser, called Firesheep, made worldwide headlines last October. With a couple of clicks, even the most unsophisticated user could take over the identity of anybody else on the same network that happened to be browsing any of a few dozen popular websites. (Mr Schumer fingered Firesheep in his public appearance.) Second, the growth of smartphones and tablets with Wi-Fi connectivity—along with the spread of free networks in America—dramatically increased the number of proximate targets. A few years ago a sidejacker (or "sniffer") might have had access to a handful of laptops from which to siphon data; now hundreds of smartphones and slates can be logged on to such networks at any given time.

More worrisome than sidejacking is the wholesale interception of unsecured web traffic by governments. This allegedly happened in Tunisia and is believed to occur routinely in many countries. The open internet in many countries passes through a series of chokepoints at which interception is trivial and may, in fact, be mandated. HTTPS does not solve the problem entirely—tracking internet addresses accessed by users may provide indirect information about contacts. But encryption hampers governments or other parties that want to view the content of messages. It also makes it more difficult to maintain that interception did not occur.

There are other niggles. A widely known proof of concept from 2009, called sslstrip, intercepts unsecured web traffic on an open network and rewrites HTTPS links into plain HTTP or redirects them to malicious secured sites that use lookalike domain names. Users have to be attentive, or install additional security extensions, to identify attacks using this approach. Should the common form of sidejacking become trickier to execute, the use of this more elaborate ruse would doubtless spread.

Major websites now generally offer secured connections but not as a default option. Mr Schumer recommends they ought to do just that. He is right. Without securing a connection from start to finish, users are vulnerable to identity theft, and much worse, by anyone that happens to be sitting in a convenient spot in the sequence of connections from user to server. While Mr Schumer prefers to stress the public-hotspot end of the chain, HTTPS guards against government meddling, too.