I'll fire up a browser and visit and I log in with my MediaWiki username and password. This means accepting phony certificates, which is as easy as a single click of a button of an impatient and confused Sheep, has enormous implications.

Once the certificate is accepted and is in your browser's database, the browser will never warn you when that certificate is being used, meaning an attacker can conduct a man-in-the-middle at any time without you being aware. However, if you accept that certificate, even once, the browser will permanently store it in a database, and it will be very difficult to remove. When you use HTTPS and experience a man-in-the-middle attack, you are presented with a warning that the certificate appears invalid. However, if an attacker had access to your machine, they could steal your private key and use it to decrypt your HTTPS traffic with Wireshark ( and and ). When you use HTTPS, you prevent a man-in-the-middle attacker from being able to decrypt traffic - that would require your private key. This is nuanced, however, so a novice unfamiliar with Wireshark might be tricked into thinking that HTTPS is hiding the destination of their HTTPS traffic. For example, HTTPS does not protect the destination of the traffic.

However, it's also important to understand what HTTPS does NOT protect. Over on the Man in the Middle/Wired/ARP Poisoning and Anonymous Browsing pages, I mention the danger of man-in-the-middle attacks and traffic sniffing, and the protection that HTTPS can offer you by encrypting your traffic. 1.3 Sometimes Destinations are More Obvious.

1.2 Determining HTTPS Traffic Destination.

Wireshark https requests