4

I want to buy a domain name from a big registar (well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” and I am asked to enter my credit card information. My question is, is it safe to enter my credit card and pay? If it's not fully encrypted can my data be sniffed?

If it helps, I'm running a Unix-like system, so can't be a keylogger or a hoax or a phishing attack. My hosts file is intact.

1
  • 12
    "If it helps, I'm running a unix like system, so can't be a keylogger or a hoax or a fishing attack." - oh yes it can (though the symptom you describe is much more likely to be a badly written website) May 1, 2011 at 17:14

3 Answers 3

15

"Connection partially encrypted" means that some parts of the page you see came outside of the SSL tunnel; most probably, the main page was served over HTTPS but contains links to inline images with plain HTTP URL. This is not really dangerous per se, but still kind of sloppy. It does not speak well for their ability to manage security issues.

When you write your credit card number in a Web page, the data will be sent to whatever URL was set in the form as "submit action". This can be seen in the page source. On a general basis, if you send some rather sensitive information (your credit card number) to somebody, then you are trusting that person to apply some care in the handling of said information. Since the warning you got demonstrates a low level of competence of the site manager in the matter of security, I would say that giving them your credit card number may not be the best idea ever.

4
  • 2
    This sort of partial encryption certainly can be dangerous. There are lots of ways to attack a machine via media like inline images, and if they are left outside the SSL tunnel, they can be replaced by other dangerous images by a MITM. Whether or not that seems dangerous for this particular circumstance, it is indeed evidence that the registrar shouldn't be trusted, @Lispninjutsu.
    – nealmcb
    May 1, 2011 at 20:24
  • 3
    The real issue are css or javascript files because they allow to change the form submission target or send a copy of data elsewhere without it being visible when looking at the form element in the source code view. May 1, 2011 at 22:13
  • 1
    In addition to @nealmcb's and @nhnb's comment, session cookies (that are not marked secure) can also be exposed.
    – AviD
    May 3, 2011 at 9:05
  • 3
    @Lispninjutsu in addition to @Thomas' comment about not trusting them with your credit card, you wouldnt want to be trusting your entire domain to a security-incompetent registrar.
    – AviD
    May 3, 2011 at 9:06
4

I'd say it's probably relatively safe to enter in your credit card number, for one reason alone: if your credit card number is stolen and someone makes fraudulent charges on your credit card, you can dispute the charges and your credit card company will reverse the charges. It'll be a hassle but in the end you shouldn't lose money. This is a significant non-technical protection, and I'd say it outweighs the technical considerations.

However, apart from that, @Thomas Pornin's answer is spot on.

3
  • I honestly dont think that "I can dispute it later" is a valid way to approach CC security online. Disputes can take time to process and investigate and having that mindset makes people careless when using CC online.
    – paan
    May 3, 2011 at 6:30
  • 3
    @paan, are you half as careful in 3D world with your credit card, and who you hand it to, as you are online? Credit cards are inherently a non-secure mechanism, and the only reason online systems are more vulnerable is the mass-theft aspect. Which doesnt really make a difference for you...
    – AviD
    May 3, 2011 at 9:08
  • 2
    @paan, why should anyone care about whether it is "valid", whatever that means? The question is whether it is reasonably safe in practice for @Lispninjutsu. We're talking about a very pragmatic question here. "Careless" is judgemental terminology that seems irrelevant; the goal is to conclude a transaction securely, not to score points for being the most paranoid security-conscious user ever. (Security is a means to an end, not an end in itself.) And do remember, nothing is perfectly safe; crossing the road is not perfectly safe.
    – D.W.
    May 3, 2011 at 20:07
-1

@dw & Avid

Valid is a strong word. Maybe should rephrase that sentence but the sentiment of the statement still stands.

"I can dispute it later" is not a good security approach in my opinion.

I DO practise the same amount of care with my CC in meatspace, I don't let the cashier disappear to the back of the office with my credit card and I have a masking tape over the CVV to cover it up and check if its been mess with when I got it back.

Careless is defined as "Not giving sufficient attention or thought to avoiding harm or errors" and if you go around putting your cc number in places that you yourself are sure of the credibility off, then you ARE "not giving sufficient attention to avoiding harm/errors"

I am pretty sure that the site just probly have some images not in ssl which causes the message, I don't think that the SSL connection have been compromize by a MitM and its probably safe to use the credit card here. And if you are saying because of that it is safe to use the CC, then I agree. But what I take issue with is when someone is advised that it is probably safe BECAUSE you can dispute it later(which is what I feel is happening here).

What I am getting at is that being careless with your credit card and then saying that you can dispute it later is a similar approach to security as saying you don't want to keep your computer virus free cause you can just wipe it and reinstall later.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .