Security when shopping or banking online

[Halogen]

How does it work? How do they secure a connection? From what I understand they use something like SSL programming language but how does it work? How does security of banks/shops work online? What makes it safe?

Googles searches are against me today .

Halogen

 

[Gamer]

I don't know the answer, but if I remember correctly, it was Mark Shuttleworth who persued the same answer and became a billionaire finding it.

 

[davemc]

1. You have to be able to uniquely identify your computer. Usually the CPUID can be enabled in BIOS and that can be used on one of the CPU's.
2. A "key" is generated encoded with a loong secret key is generated and kept on your computer which is merged with another looong seceret key that is kept by the Trusted Security keys company.
3. This "key" from step 2 is then used to produce a certificate, which is just a nice way of storing the merged key and the details of who makes up the key. One certificate per computer. The cxertificate is encrypted using the key on the computer, not the merged key.
4. Now, if another piece of software wants to make sure that he is communicating with that specific computer, that piece of software asks the computer for it's certificate, which the computer readily supplies, but it first unencrypts the certificate using it's local key, the software then examines the certificate, and detemrines who the "trusted" publisher was, and asks the publisher to verify the certificate. This the publisher does, using it's key.
5. Now that the software can "trust" the computer that it is talking to, it uses a part of the certificate as the key to encrypt all transmissions that it sends to the "trusted" computer.
6. The encryption used is called SSL, or Secure Sockets Layer.

Exactly how the certificates are formed and verified varies from trusted provider to trusted provider, but what is definite is that the computer must prove that it is the computer mentioned in the certificate.

That is what the whole trusted certificates is all about.

Edit : Also, the trusted security company is literally split into secure sections, where one employee is not allowed to know what another employee knows, and the trusted company has very strict procedures in place that are monitored to ensure that no employee will ever have enough information to generate a trusted key.

 

[Halogen]

Shot davemc helpful info......and it seems like google is my friend again

 

[gregmcc]

What he said - although I don't agree with the CPUID.

When generating the public/private key - its based on the operating system's pseudo number generator and not reliant on the hardware. You can complely swap out the hardware that the CSR was genrated on and it will still work.

Maybe some of the physical CA machines use the CPUID though?

Here's a few more interesting links to help you out:

http://en.wikipedia.org/wiki/Certificate_signing_request

http://en.wikipedia.org/wiki/Key_pair

http://en.wikipedia.org/wiki/Transport_Layer_Security

 

[sn3rd]

The whole idea is based on the notion of asymmetric encryption. It turns out that we can use mathematical relationships to generate keys that are related to one another, but it is infeasible to try to compute one from the other. If we call one key a private key (because only we know it) and another a public key (because everyone knows it), then people can use the public key to encrypt messages and only we will be able to decrypt them (with the private key; the public key won't decrypt the message). In the same way, we can encrypt a message with the private key and anyone can decrypt it with the public key. Because we are the only ones who know the private key, people can be confident that messages decrypted with the public key were encrypted by us and not a malicious third party. The first case provides confidentiality while the second case provides message-integrity and authentication.

SSL uses these ideas.

A trusted third party can generate a public and private key pair and make only the public key freely available. A person or company can generate a certificate with their credentials and request that the trusted third party verify the details and sign off on it (with their secret private key). Because the public key is freely available, anyone can check that the trusted third party signed off by decrypting the certificate. And because only the trusted third party has their private key, only they could have signed off.

SSL defines a protocol that uses these ideas to verify identities. And it can be used to provide confidential messaging too.