CheckMyHTTPS Autor: CheckMyHTTPS Team

When browsing on secured sites ("https://..." websites), you can check the security status by clicking on the extension icon (check).

• The icon is green : your connection is not compromised;
• The icon is red : your connection is considered very risky (hijacked, modified, listened);
• The icon is blue : the verification is impossible (check server is unreachable, web site is whitelisted);
• The icon is gray : the verification is in progress.

Technical details :
Normally, before encrypting an HTTPS connection, a secure website must prove its identity to your browser by sending it its security certificate. This certificate can be considered as an identity card issued by higher authorities (Certificate Authorities). There are several techniques of usurpation based on false certificates (false identity cards) or homographers (false names) to make you believe that a "pirate" site is the legitimate site you think you are visiting. These techniques allow pirate sites to retrieve your private information.
CheckMyHTTPS allows you to detect this type of practice, which can be implemented on open networks (WiFi in hotels, conference centers, stations, etc.) or even within your company via its firewall (SSL inspection). To detect this, the extension compares the certificate of the visited site that is received by your browser with the same certificate retrieved by an external "verification server" located on the Internet. If the certificates differ, the identity of the server can be considered as usurped (red icon).

Respect for privacy?
- The CheckMyHTTPS extension requires only two parameters : The name of the visited website and the certificate received from it;
The external "verification server" only receives the name of the visited website. If you want, you can make this "verification server" yourself.

All explanations are detailed on the project website : checkmyhttps.net.