A website shows the HTTPS padlock. What does that guarantee?
Options
- The website is honest and safe to browse and use
- The traffic is encrypted and the domain has a cert (Correct option)
- The site has no bugs of any kind in its code
- Your password is stored safely by the website
Answer
The connection to that domain is encrypted and the domain owns its certificate; it says nothing about whether the site is trustworthy
Why
The padlock means TLS is working: nobody in between can read or change the traffic, and the certificate matches the domain name.
A phishing site like paypa1-login.com can also get a valid certificate and a padlock.
It also says nothing about how the site stores your data.
Remember
Padlock = encrypted connection, not a trustworthy site.