1) Baseline: what HTTPS actually protects

When you visit https://site.com, your browser expects two things: