I have learnt little about https. But was not clear the need of it. What if i encrypt the data using the most powerful algorithms like RSA instead of sending through a HTTPS zone?? Can someone suggest few points on why we need https??
closed as not constructive by Greg Askew, growse, John Gardeniers, EEAA, Tim Brigham Sep 9 '12 at 0:21
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.
First, RSA is a authentication mechanism, not encryption. AES is an encryption algorithm, probably the one you're thinking of.
Second, HTTPS is well supported and fairly easy to implement, it's also very complete and well audited. There is no good reason that you can't create you're own mechanism based on whatever encryption technology you want, but you'll lose the befits described above.
The user's browser would be encrypting it with the public key provided by the server.
Without HTTPS, that server could easily be a man-in-the-middle attack. Now, you've provided your nicely encrypted, highly sensitive data to the wrong server.