The basic security of communication on the Internet depends to a large extent on the authentication methods used and the encryption of data during transmission.

In implementing these methods, it is possible for errors to be made that prevent effective authentication and encryption. Furthermore, many web services still offer outdated encryption methods. As a result, attackers can bypass server authentication techniques, and communications or data may not be sufficiently encrypted. This may allow unauthorised individuals to access or modify information as it is being transmitted. In the past, certification bodies have also been compromised, allowing attackers to obtain certificates for third-party websites.