SECURITYATLAS✳

✳ Misconception M1 / F3

Encryption does not mean you reached the right owner

TLS 1.3 encryption protects the bytes in transit and verifies that the server holds the private key for the domain name in its certificate, but it never proves that a lookalike domain belongs to the organization the user intended to reach.

Wrong claim

Why it feels true

A browser padlock on a lookalike portal (chronos-orbital-login.example) looks like cryptographic proof that the engineer is connected to Meridian Space & Robotics (chronos.orbital).

Precise correction

Transport Layer Security (TLS) 1.3, defined in RFC 8446 (August 2018), encrypts session traffic against passive eavesdroppers and verifies that the server's X.509 certificate matches the hostname the browser requested.

However, Certificate Authorities validate control of the requested domain string, not whether that domain is the real company the user meant to visit or whether a specific telemetry action is authorized.

When a phishing link or DNS redirection sends an engineer to an attacker-owned lookalike domain with its own valid TLS certificate, encryption works flawlessly for the wrong owner.

RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 (August 2018) ↗

MINI-CHECK

Contractor Dax Mercer connects over airport Wi-Fi, sees a valid HTTPS padlock on chronos-orbital-auth.example, and types a Meridian password instead of using a FIDO2 hardware key. What did the TLS session actually prove?

Go deeper

Find your next idea.

Tip: press / to open search. Escape closes this window.