SSL vs non SSL shopping sites

[Grimspoon]

Ok I need to clear this up so please advise.

If you have a online store and you don't use SSL but all credit card details and processing is handled via lets say paygate or whatever, is this is completely crazy and unsafe model?

So the customer picks his / her items, click checkout, selects credit card, puts their CC details in, clicks on continue to confirm order, and then once clicking confirm it goes directly to the payment gateway, so essentially nothing is happening on your site with regards to the CC processing. It leaves your site completely and gets done on the gateways side.

Please can someone explain how this model should work and if the above method is truly insecure.

 

[koeksGHT]

SSL is just encryption between your computer and the server, so if the online store doesn't have SSL when you enter your details in the store web page and click checkout the packets can be intercepted because of the no encryption between you and the store. If you enter you CC details directly on the payment gateway with SSL they should be safer (dunno about some new SSL flaw they found)

 

[murraybiscuit]

let's pretend you give somebody your account login but not your cc details.
what's the worst they could do?

 

[Grimspoon]

SSL is just encryption between your computer and the server, so if the online store doesn't have SSL when you enter your details in the store web page and click checkout the packets can be intercepted because of the no encryption between you and the store. If you enter you CC details directly on the payment gateway with SSL they should be safer (dunno about some new SSL flaw they found)

Thanks for the info. What are the chances or how easy can these details be intercepted.

I am just reading up on this, and they say that you dont really need a SSL if you have a 3rd party payment provider BUT if any CC details are entered onto your site then you should have one. In my case even though the actual transaction happens via 3rd party and no CC details are stored, they are entered onto the site first. Is this a concern?

let's pretend you give somebody your account login but not your cc details.
what's the worst they could do?

Well put. If someone "broke" into any of our customers accounts, there really is nothing they can do as no CC details are stored.

But as I mentioned above, they are entered onto the site when purchasing and then the 3rd party payment gateway kicks in.

 

[HavocXphere]

What are the chances or how easy can these details be intercepted. .

Pretty low imo. Its just too much data to sift through, plus you'd need access to the infrastructure somehow. Main risk comes from a flakey company or if your PC/environment is compromised somehow.

EDIT: Looks like your interested from a suppliers perspective. Then you definitely need SSL. Not for the security, but rather to boost sales. All most people know about this is you look for that lock sign at the bottom of the internet explorer....

 

[|tera|]

Have a look at my shop for some examples of how I do it Grimpsoon. My entire payment procedure is handled by payfast.co.za, SSL encrypted.

To have my entire shop on a SSL connection is really damn cheap per year, but I am not ready to commit to the cost yet, as I have a ton of products still to load before I will see any sales in any case.

My drawback at this stage is my internet connection. I made my entire shop with a CellC Edge connection, so I had to be really conscious of bandwidth etc.

Payfast will charge me a "fee" per transaction and I opted not to have Credit Card payments at this stage, but I will do it in future.

I hope it helps a bit.

 

[Grimspoon]

Pretty low imo. Its just too much data to sift through, plus you'd need access to the infrastructure somehow. Main risk comes from a flakey company or if your PC/environment is compromised somehow.

EDIT: Looks like your interested from a suppliers perspective. Then you definitely need SSL. Not for the security, but rather to boost sales. All most people know about this is you look for that lock sign at the bottom of the internet explorer....

Thanks for the reply. I agree, the piece of mind for clients is probably more important than the small possibility of someone hacking CC details.

Have a look at my shop for some examples of how I do it Grimpsoon. My entire payment procedure is handled by payfast.co.za, SSL encrypted.

To have my entire shop on a SSL connection is really damn cheap per year, but I am not ready to commit to the cost yet, as I have a ton of products still to load before I will see any sales in any case.

My drawback at this stage is my internet connection. I made my entire shop with a CellC Edge connection, so I had to be really conscious of bandwidth etc.

Payfast will charge me a "fee" per transaction and I opted not to have Credit Card payments at this stage, but I will do it in future.

I hope it helps a bit.

Thanks Tera, which site is yours? One of the links in your sig? Checked them out couldn't see exactly.

We not concerned about the 3rd party so much, just worried about having clients put CC details in on our site in plain text, even though these are not stored or processed on our page.

I see a full SSL cert is about R1800 a year. Thats not to bad. I see you can also get SSL on only certain pages? Is that correct? Would probably be best to get it for the whole site for piece of mind?

 

[The_Ogre]

Thanks for the info. What are the chances or how easy can these details be intercepted.

Quite easily. Read up on Packet Sniffers

I am just reading up on this, and they say that you dont really need a SSL if you have a 3rd party payment provider BUT if any CC details are entered onto your site then you should have one. In my case even though the actual transaction happens via 3rd party and no CC details are stored, they are entered onto the site first. Is this a concern?

Yes. Think of it this way.

With SSL:
A key is used to encrypt data between the user and your server. Only the user's browser and your server knows what the key is. So even if the packets are intercepted the hacker can't do jack with it. Or he can try for years to decipher it

Witout SSL:
The user's browser and your server is not using any keys. Any data moving between these two can be intercepted.

But as I mentioned above, they are entered onto the site when purchasing and then the 3rd party payment gateway kicks in.

The data first needs to get to your site / server before the payment gateway comes into play. While the data is in transit from the user it can still be sniffed.

 

[|tera|]

Thanks Tera, which site is yours? One of the links in your sig? Checked them out couldn't see exactly.

We not concerned about the 3rd party so much, just worried about having clients put CC details in on our site in plain text, even though these are not stored or processed on our page.

I see a full SSL cert is about R1800 a year. Thats not to bad. I see you can also get SSL on only certain pages? Is that correct? Would probably be best to get it for the whole site for piece of mind?

Yes, it's the last link in my Sig, just scroll down a bit on the home page and click on the Logo to view it.

SSL may cause problems on certain "shops", cms software etc. etc. that's why some options are available per page, for instance your client area, checkout etc.

On my shop I don't "store" any client data, except for the email account, password and physical address. The actual payment data is handled by Payfast, so I wouldn't even know what my client's details are, except that I received an EFT payment for Amount from Account, blah blah blah. LOL

I've basically removed the headache so it's not something I have to concern myself with.

I can get a SSL Cert for my site with my host (texo) for about R250 per year IIRC. That gives me a static IP as well. You can't use a SSL Cert on shared hosting.

 

[HavocXphere]

While the data is in transit from the user it can still be sniffed.

Which is why I've got my trusty packet sniffer jacked straight into the Seacom Cable. Remember that outage a few months ago... /jk

Rather safe then sorry, but seriously nobody is going to sniff CC details. Those you can buy in bulk packs in the shadier corners of the interwebs....going rate is less than a dollar per CC if I'm not mistaken.

 

[encrypted]

If the credit card details are transmitted unencrypted (the page you enter them on does not need to be SSL, just the destination it posts to) and the details are intercepted and stolen the fine is $500 000 about.

People like to see SSL tho and a cert is about $50

 

[Grimspoon]

Quite easily. Read up on Packet Sniffers


Yes. Think of it this way.

With SSL:
A key is used to encrypt data between the user and your server. Only the user's browser and your server knows what the key is. So even if the packets are intercepted the hacker can't do jack with it. Or he can try for years to decipher it

Witout SSL:
The user's browser and your server is not using any keys. Any data moving between these two can be intercepted.

The data first needs to get to your site / server before the payment gateway comes into play. While the data is in transit from the user it can still be sniffed.

Thanks Grav you explained it nicely. I am just going to get a full SSL cert, for the amount it really is not a big deal. 1 order will pay for the monthly amount if you break it up. Seems silly not to have it. I always thought SSL certs were outrageously expensive like R20k a year.

Yes, it's the last link in my Sig, just scroll down a bit on the home page and click on the Logo to view it.

SSL may cause problems on certain "shops", cms software etc. etc. that's why some options are available per page, for instance your client area, checkout etc.

On my shop I don't "store" any client data, except for the email account, password and physical address. The actual payment data is handled by Payfast, so I wouldn't even know what my client's details are, except that I received an EFT payment for Amount from Account, blah blah blah. LOL

I've basically removed the headache so it's not something I have to concern myself with.

I can get a SSL Cert for my site with my host (texo) for about R250 per year IIRC. That gives me a static IP as well. You can't use a SSL Cert on shared hosting.

I store full client details, just no CC details so it is probably in my and the clients best interest to secure this as best as possible.

 

[Grimspoon]

If the credit card details are transmitted unencrypted (the page you enter them on does not need to be SSL, just the destination it posts to) and the details are intercepted and stolen the fine is $500 000 about.

People like to see SSL tho and a cert is about $50

Seriously? $500 000? Who fines you for that? And who even has that kind of cash lol.

Well the cc details are entered on the site and then "pay now" obviously sends those cc details to the payment gateway, I guess that is a issue there correct?

 

[The_Ogre]

Rather safe then sorry, but seriously nobody is going to sniff CC details. Those you can buy in bulk packs in the shadier corners of the interwebs....going rate is less than a dollar per CC if I'm not mistaken.

That is true

But ask anyone who has some minute knowledge of IT and you find that most people won't shop at a site that doesn't use a security certificate. Ok I might be exaggerating a bit, but you get my point.

I even taught my wife that if she doesn't see the shaded part before the address in the address bar she shouldn't enter any confidential information.

 

[The_Ogre]

On a side note.

If you really want to be flexible to your customers - and I don't know what goods or service you're selling - provide for an EFT option as well.

Lots of people do not have credit card or cheque cards linked to Visa / Mastercard, etc. Also, some people are scared to use their credit card online, purely because of their ignorance in understanding how the security around online purchases work

 

[|tera|]

I store full client details, just no CC details so it is probably in my and the clients best interest to secure this as best as possible.

If you do, I won't disagree with your decision. I will also get my SSL Cert a bit later, possibly early next year. As I say, I've got a lot of work on the shop still ahead of me.
My prices rock though, which I'm happy about. I'm a true turn over bunny and the big shopping guys are going to feel a small pinch once I'm on the block hahaha.

 

[koeksGHT]

It is a nice feeling when your browser has the huge padlock and your data is encrypted, chances of packets actually been intercepted are low but it's nice to know even if they are there is some security in place.. Defiantly gives a piece of mind to the buyers.

 

[4kix]

Well the cc details are entered on the site and then "pay now" obviously sends those cc details to the payment gateway, I guess that is a issue there correct?

Yes, because the cc details will be transmitted via the querystring or POST header in clear text, thereby potentially exposing them.