Safe Browsing and Privacy

The Browser as a Security Frontier

The web browser is, for most people, the main gateway to the Internet and therefore one of attackers' favorite targets. Through it pass credentials, banking data, private communications, and browsing habits. Protecting it and using it judiciously is essential for everyday security.

Modern browsers incorporate numerous defenses: tab isolation (sandboxing), blocking of known malicious sites, certificate warnings, and frequent updates. Keeping the browser updated is as important as keeping the operating system updated, since browser vulnerabilities are actively exploited.

Beyond technology, much of online safety depends on user behavior: which links you follow, what you download, and what information you share. This lesson combines both aspects: the tools and the habits.

HTTPS and Verifying Connections

As we saw in the cryptography lesson, HTTPS encrypts the traffic between your browser and the website, protecting it from interception and manipulation. Today it is the expected standard: the vast majority of legitimate sites use it, and browsers mark any page that requests data over plain HTTP as "not secure."

However, HTTPS only guarantees that the connection is private, not that the site is legitimate. A phishing site can also have a valid padlock. That is why you should always verify the real domain in the address bar, distrust names that imitate well-known brands with small variations, and never enter credentials after arriving from an unsolicited link.

Certificate warnings —"your connection is not private," expired or mismatched certificate— must not be ignored. They may indicate a configuration error, but also an interception attempt, especially on public networks.

Cookies and Tracking

Cookies are small files that websites store in your browser. Session cookies are useful and necessary: they keep you logged in and remember your preferences. But third-party cookies and other tracking mechanisms let advertising networks follow you across multiple sites, building a detailed profile of your interests and behavior.

There are even more persistent tracking techniques, such as fingerprinting, which identifies your device by the unique combination of its characteristics (browser, resolution, installed fonts) without needing cookies. That is why privacy requires active measures beyond clearing cookies now and then.

To reduce tracking you can use privacy-focused browsers, extensions that block trackers and ads, private browsing mode for one-off sessions, and periodically review stored permissions and cookies. Configuring the browser to block third-party cookies is a good starting point.

VPN: What It Protects and What It Does Not

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a remote server, hiding your traffic from whoever controls the local network and masking your IP address from the sites you visit. It is especially useful on public Wi-Fi networks, where other users might try to intercept your traffic.

It is important to understand its limits. A VPN does not make you anonymous nor protect you from malware or phishing; it simply shifts trust from your local Internet provider to the VPN provider, which can now see your traffic. That is why choosing a reputable provider, with a good no-logs policy and a clear business model, is essential. "Free" VPNs often monetize your data.

For most sites, which already use HTTPS, traffic is encrypted end to end even without a VPN. A VPN adds an extra layer of privacy and is valuable on untrusted networks, but it does not replace the other defenses.

Protecting Your Personal Data

Privacy starts by sharing less. Every piece of data you publish —date of birth, location, names of relatives— can be used for social engineering, identity theft, or to answer security questions. Apply the principle of minimization: provide only the information strictly necessary for each service.

Review the privacy settings of your social networks and apps, limit the permissions you grant (location, microphone, contacts), and be wary of quizzes or giveaways that ask for personal data. Staying alert to data breaches and which services were compromised lets you change passwords in time.

Finally, remember that privacy and security reinforce each other: the less information about you circulates, the less material attackers have to direct their attacks. In the final lesson we will bring all these concepts together into a coherent security mindset.