We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
This idea carries a full system design question on its own. Each walks through the full answer.
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
Before TLS was widespread, traffic traveled in plain text. Anyone on the same Wi-Fi network, the person at the next table in a coffee shop, could capture your traffic with a packet sniffer and read your passwords, emails, credit card numbers, and every page you visited. Tools like Firesheep (2010) automated session hijacking so completely that a non-technical person could steal Facebook sessions from everyone in a Starbucks with a single Firefox extension.
TLS (Transport Layer Security) encrypts the communication channel between a client and a server. Even if an attacker intercepts the traffic, they see encrypted gibberish. TLS also authenticates the server, proving that you are actually talking to your bank and not an impersonator, and ensures data integrity, detecting any tampering during transit.
TLS is not optional. Every production system must use TLS. Browsers mark HTTP sites as "Not Secure." Search engines penalize them. And any system transmitting user data over unencrypted connections is a compliance violation under GDPR, PCI-DSS, HIPAA, and virtually every other regulatory framework. Cloudflare reported in 2023 that over 95% of their traffic is now encrypted with TLS, up from under 50% in 2014.
TLS has a long history, and getting the version right matters. Running an outdated version is worse than it sounds because known attacks exist against every version prior to TLS 1.2.
SSL 2.0 and 3.0 are dead. POODLE (2014) killed SSL 3.0, and DROWN (2016) killed any server that still had SSL 2.0 enabled, even as a fallback. TLS 1.0 and 1.1 were deprecated by all major browsers in 2020. PCI-DSS has required TLS 1.2 or higher since June 2018.
TLS 1.3, published as RFC 8446 in August 2018, is the current standard. Cloudflare enabled it across their entire network on day one of the RFC. Google reported that 90%+ of Chrome connections used TLS 1.3 by 2023. If your server still negotiates TLS 1.1, you are running a protocol with known vulnerabilities and your users are getting browser warnings.