Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Greetings, I want to buy a domain name from a big registar(well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” and I am asked to enter my credit card information. My question is, is it safe to enter my credit card and pay? If it's not fully encrypted can my data be sniffed?

If it helps, I'm running a unix like system, so can't be a keylogger or a hoax or a fishing attack. My hosts file is intact.

I'm waiting for a reply, thanks.

share|improve this question
10  
"If it helps, I'm running a unix like system, so can't be a keylogger or a hoax or a fishing attack." - oh yes it can (though the symptom you describe is much more likely to be a badly written website) –  frankodwyer May 1 '11 at 17:14

3 Answers 3

up vote 15 down vote accepted

"Connection partially encrypted" means that some parts of the page you see came outside of the SSL tunnel; most probably, the main page was served over HTTPS but contains links to inline images with plain HTTP URL. This is not really dangerous per se, but still kind of sloppy. It does not speak well for their ability to manage security issues.

When you write your credit card number in a Web page, the data will be sent to whatever URL was set in the form as "submit action". This can be seen in the page source. On a general basis, if you send some rather sensitive information (your credit card number) to somebody, then you are trusting that person to apply some care in the handling of said information. Since the warning you got demonstrates a low level of competence of the site manager in the matter of security, I would say that giving them your credit card number may not be the best idea ever.

share|improve this answer
    
Thank you very much. Your answer was very helpful. –  Lispninjutsu May 1 '11 at 18:12
2  
This sort of partial encryption certainly can be dangerous. There are lots of ways to attack a machine via media like inline images, and if they are left outside the SSL tunnel, they can be replaced by other dangerous images by a MITM. Whether or not that seems dangerous for this particular circumstance, it is indeed evidence that the registrar shouldn't be trusted, @Lispninjutsu. –  nealmcb May 1 '11 at 20:24
3  
The real issue are css or javascript files because they allow to change the form submission target or send a copy of data elsewhere without it being visible when looking at the form element in the source code view. –  Hendrik Brummermann May 1 '11 at 22:13
1  
In addition to @nealmcb's and @nhnb's comment, session cookies (that are not marked secure) can also be exposed. –  AviD May 3 '11 at 9:05
3  
@Lispninjutsu in addition to @Thomas' comment about not trusting them with your credit card, you wouldnt want to be trusting your entire domain to a security-incompetent registrar. –  AviD May 3 '11 at 9:06

@dw & Avid Valid is a strong word. Maybe should rephrase that sentence but the sentiment of the statement still stands.
"I can dispute it later" is not a good security approach in my opinion.

I DO practise the same amount of care with my CC in meatspace, I dont let the cashier disappear to the back of the office with my credit card and I have a masking tape over the CVV to cover it up and check if its been mess with when I got it back.

Careless is defined as "Not giving sufficient attention or thought to avoiding harm or errors" and if you go around putting your cc number in places that you yourself are sure of the credibility off, then you ARE "not giving sufficient attention to avoiding harm/errors"
I am pretty sure that the site just probly have some images not in ssl which causes the message, I dont think that the SSL connection have been comprimize by a MitM and its probly safe to use the credit card here. And if you are saying because of that it is safe to use the CC, then I agree. But what I take issue with is when someone is adviced that it is probly safe BECAUSE you can dispute it later(which is what I feel is happening here).

What I am getting at is that being careless with your credit card and then saying that you can dispute it later is a simmilar approach to security as saying you dont want to keep your computer virus free cause you can just wipe it and reinstall later.

PS:Sorry that I put this as an answer. I tried replying in the comments and this is too long. Feel free to votedown/delete/whatever if you think that this is unappropriate as an answer.

share|improve this answer

I'd say it's probably relatively safe to enter in your credit card number, for one reason alone: if your credit card number is stolen and someone makes fraudulent charges on your credit card, you can dispute the charges and your credit card company will reverse the charges. It'll be a hassle but in the end you shouldn't lose money. This is a significant non-technical protection, and I'd say it outweighs the technical considerations.

However, apart from that, @Thomas Pornin's answer is spot on.

share|improve this answer
    
I honestly dont think that "I can dispute it later" is a valid way to approach CC security online. Disputes can take time to process and investigate and having that mindset makes people careless when using CC online. –  paan May 3 '11 at 6:30
3  
@paan, are you half as careful in 3D world with your credit card, and who you hand it to, as you are online? Credit cards are inherently a non-secure mechanism, and the only reason online systems are more vulnerable is the mass-theft aspect. Which doesnt really make a difference for you... –  AviD May 3 '11 at 9:08
2  
@paan, why should anyone care about whether it is "valid", whatever that means? The question is whether it is reasonably safe in practice for @Lispninjutsu. We're talking about a very pragmatic question here. "Careless" is judgemental terminology that seems irrelevant; the goal is to conclude a transaction securely, not to score points for being the most paranoid security-conscious user ever. (Security is a means to an end, not an end in itself.) And do remember, nothing is perfectly safe; crossing the road is not perfectly safe. –  D.W. May 3 '11 at 20:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.