Cyber security · Interactive model

The Coffee-Shop Wi-Fi

You're on the free café Wi-Fi, logging into your bank. Your login crosses the network in packets — and someone two tables over is quietly capturing every one. The padlock in your address bar is supposed to save you. Guess how much it actually hides — then watch the packets and see for yourself.

Guess first — commit before you look

HTTPS is on, the padlock is showing. What can the person two tables over actually read?

Your password and everything you type The café network is wide open, so it's all up for grabs. Nothing — with the padlock they just see noise Encryption is encryption; there's nothing left to read. Not the contents — but which sites you're visiting The message is sealed, but it still has to be delivered somewhere.

Watch the packets

Flip the switches and watch what the eavesdropper captures below.

What the attacker captured

Every packet crossing the network, as they see it.

Where this bites

The same two facts — contents are sealed, everything else leaks — in the wild.

VPNs

Trust moves, it doesn't vanish

A VPN hides the destination from the café — but the VPN provider now sees every site you visit. Encryption relocates who you have to trust; it never removes the need to trust someone.

Phishing

A valid padlock on the wrong door

An evil twin or look-alike domain can serve a page with a perfectly green padlock — encrypting your credentials straight to the attacker. The lock certifies "encrypted," never "authentic." Read the domain, not the icon.

Metadata

"Which sites" is a profile

Even fully encrypted, the network sees the domains you reach (via DNS and the TLS handshake), plus timing and volume. A therapy site at 2am, then a pharmacy — the pattern tells the story without reading a word.

Plain HTTP

One un-locked hop is enough

A form that posts over HTTP, a mixed-content page, an internal admin panel with no cert — one missing padlock and the postcard is back, readable by every device on the network.

Encryption protects the contents of the pipe — and nothing else. It can't hide where you're going, and it never proves who's on the other end. So on any network you don't control, trust the domain in the address bar, not just the lock beside it.