I've been tasked with trying to find a way to secure a single page in our site if somehow, a hacker gets access to our files. This "single page" will be run on a different server.
- Show the user something that lets them know they are definitely viewing the right page
That's about it actually.
The idea being that during a process in our site, the user would navigate to this page, see something that lets them know "you are really at the page you want". That "something" could even be a url that points to a specific server running SSL.
However, I can't really think of any full-proof system to handle this. If somehow a hacker has access to what our website is serving, I feel like they could change anything, even going to an https: url in a new browser window for that page could be spoofed couldn't it? (edit: This is an important question. Could they somehow spoof the url "https://secure.ourwebsite.com" if they hack the main website at "http://main.ourwebsite.com"? Would the browser inform the user that they were actually going to the wrong url?)
Is this an impossible task?
One potential idea would be something like this:
Client opens "http://main.ourwebsite.com". In an iframe, we load: "https://secure.ourwebsite.com". On that secure page, we have a key sent from the server. That page then uses Ajax to send that key BACK to the server, which verifies that the key was correct and shows a shiny image. This allows the user to visually see that they have a secure connection. Then when the user submits the form (on secure.ourwebsite.com) we encrypt the information and send it back over the SSL to secure.ourwebsite.com.
Is that a viable option?