HTTP

HTTP is a protocol used for unencrypted communication between web browsers and web servers. It uses TCP port 80.

HTTPS is a protocol used for SSL-encrypted and authenticated communication between web browsers and web servers. It uses TCP port 443.

S-HTTP is a lesser-used protocol for encrypted communication between web browsers and web servers. It does not use SSL, and is rarely used today.

HTTP/HTTPS

HTTP and HTTPS used to be purely web browsing protocols, but a funny thing happened on the way to the future. Network administrators the world over, started blocking firewall ports used for any services they did not feel were absolutely essential in the name of security (a good practice).

Then users were sad, because peer-to-peer chat services, instant messaging, CD database lookup programs, and other fun but non-essential utilities that used ports blocked by firewalls stopped working. Then developers deployed fancy applications using technology like Microsoft’s DCOM, and found out that because of the way most network administrators had configured their firewalls, DCOM traffic didn’t get through.

But developers everywhere, who were boxed in by network administrators’ security efforts, eventually realized that almost every site allows port 80 and port 443 traffic through – and that hiding (or tunneling) their application-specific protocols inside HTTP, was a way to get them through the firewall’s port-level blocking. Much like using a VPN tunneled inside a normal TCP/IP connection hides what’s really going on in the virtual network from the tools that manage the physical network, tunneling an application inside another application protocol like HTTP hides the workings of that inner application protocol from utilities and devices which seek to observe or filter it.

And thus, began the next chapter in the saga of hackers finding a creative way to accomplish something and security folks scrambling to prevent them from doing it. Today, many firewalls feature content filtering of HTTP traffic so that certain URL’s or URL patterns can be blocked, to prevent these other applications from piggybacking into (or out of) the site via HTTP or HTTPS.