The Internet Without Cryptography

HTTP (HyperText Transfer Protocol) was designed in the early 1990s with no encryption. Every request and response is sent as human-readable text over the network.

This means any router, ISP, or attacker between you and the server can read your login credentials, personal information, and the content of every page you visit.

In a man-in-the-middle (MITM) attack, an attacker positions themselves between two communicating parties and relays traffic, potentially reading or modifying it. On an unencrypted network, this requires no special effort.

The attacker can see all data, inject malicious content into responses, or silently modify form submissions such as changing a bank transfer destination.

Public WiFi networks are shared broadcast media. On a typical open WiFi network without encryption, every connected device can capture every other device's packets using tools like Wireshark.

In the era before HTTPS dominance, sitting at a coffee shop with a packet sniffer allowed you to harvest login sessions, read emails, and capture passwords from dozens of nearby users.

FTP (File Transfer Protocol) transmits both usernames and passwords in plaintext. A single packet capture during login reveals full credentials.

Despite this, FTP servers remained common well into the 2000s and some still exist today. SFTP (SSH File Transfer Protocol) and FTPS (FTP over TLS) are secure alternatives that encrypt both credentials and data.

DNS translates domain names into IP addresses. Without DNSSEC (DNS Security Extensions), DNS responses are unauthenticated and can be forged.

An attacker could poison a DNS cache to redirect users typing "mybank.com" to a malicious server under the attacker's control, capturing credentials before forwarding them to the real bank.

SMTP, the protocol for sending email, was designed in 1982 with no security at all. Email travels through multiple servers (mail relays) on its way to the recipient, and each hop could read or modify the message.

Without TLS on SMTP connections and end-to-end encryption like PGP, email is essentially a postcard: anyone handling it can read what is written.

In 2010, a developer released Firesheep, a Firefox extension that automated session cookie theft on open WiFi networks. With one click, it could log into someone else's Facebook, Twitter, or Amazon account.

Firesheep required no technical knowledge. It captured unencrypted session cookies broadcast over WiFi and presented a list of hijackable accounts to the attacker.

Before HTTPS became standard, early ecommerce sites sent credit card numbers in plaintext HTTP POST requests. Attackers monitoring network traffic could harvest card numbers at scale.

Early online shopping required users to trust that the site was legitimate and that no one was watching. Both assumptions were frequently wrong, leading to massive fraud losses in the late 1990s.

On an unencrypted network, attackers could read all traffic, steal session cookies to impersonate users, inject malicious scripts into web pages, capture passwords and credentials, and redirect users to phishing sites via MITM.

Large-scale surveillance was also trivially easy. An attacker with access to a major internet exchange could monitor millions of users simultaneously without detection.

HTTPS encrypts traffic using TLS, preventing eavesdropping, tampering, and impersonation. Google's 2014 announcement that HTTPS would be a search ranking signal accelerated adoption dramatically.

By 2024, over 95% of web traffic is encrypted. Let's Encrypt, launched in 2016, made free TLS certificates available to every website owner, removing the cost barrier to adoption.

The history of unencrypted internet communications illustrates why security requires multiple layers. Even if one control fails, others should limit the damage.

Modern networks combine TLS, DNSSEC, certificate transparency, HSTS, and authenticated encryption to build overlapping protections where the weakness of one is compensated by the strength of another.

Test your understanding of the dangers of unencrypted communication.

Without cryptography, every communication on the internet is visible to anyone in the path between sender and receiver. MITM attacks, session hijacking, credential theft, and DNS poisoning were trivial on unencrypted networks.

HTTPS and TLS transformed the internet from a broadcast medium into a system where private communication is possible. The shift from HTTP to HTTPS is one of the most important security improvements in internet history.