"the padlock means the site is safe"
loresecurityweb dev
The padlock proves the connection is encrypted to whoever holds that domain - it says nothing about who they are. Phishing sites get certificates in minutes, for free.
By the late 2010s most phishing pages served valid HTTPS; the FBI issued a public advisory in 2019 warning that the lock icon is not a trust signal. Browsers have been quietly demoting the padlock since.
Disputed / commonly mistold A popular version of this story is inaccurate - see the note above.
Also known as: padlock myth, green lock
Sources
- FBI IC3 PSA I-061019-PSA - HTTPS phishing (2019)
- APWG Phishing Activity Trends Reports - HTTPS share of phishing sites