Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Please note: A majority of this question is based on the facts that a lot of my members and I are one step from being tin-foil hats. If you continue to read and answer this question, please remember this.


I help run a community forums where we talk about technology news, progress being made, and overall how to try to improve the web from programming better to security standards. I have officially purchased a SSL Certificate to make myself, my staff, and some users happier with feeling like with prying eyes, we can be more secure by visiting the forums.

By forcing all members, and connections throughout the website to use https:// instead of http://, we have a sense of things are a little more better for the recent leaks of Edward Snowden and the issues which have arisen from that -- plus some with Net Neutrality.

By adding this SSL Certificate, can that help build trust that your site is more secure, with less prying eyes, and our users are technical users are trusting us more that we are doing the right thing.

Does adding a SSL Certificate help build trust with the people who are worried about security?

share|improve this question

closed as primarily opinion-based by TildalWave, Xander, Iszi, Gilles, Eric G May 14 at 13:28

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
What does net neutrality have to do with security in this context exactly? –  Eric G May 14 at 13:28
    
@EricG there is actually a few grey area laws that are still protecting https:// traffic from getting throttled by any ISP, thanks to corporations such as our banks and financial applications. –  Traven May 14 at 19:24
    
... so that's a performance concern, not a security concern then? –  Eric G May 15 at 2:37
    
The net neutrality is a performance major performance issue for the overall web and the future of the web. Also, because of the way the laws are, they can't touch https:// for now. It does make a safer web because they can't tell traffic from one another thanks to it. All they can see is data. Data is data, period. –  Traven May 15 at 2:58
    
Also some proof to back it up form SuperUser.com superuser.com/a/231992/320669 –  Traven May 15 at 3:00

2 Answers 2

up vote 10 down vote accepted

An SSL Certificate provides three things:

  • confidentiality
  • integrity
  • authentication

However it only provides these three things to the connection between client and server. Does this make your website more secure? Yes and no.

It ensures as you say that prying eyes will not be able to sniff username and password when this data is in transit between client and server.

However SSL does not provide any guarantee on the way you coded your application, manage your server, handle confidential data or grant and distribute privileged access. Security is much more than just adding SSL certificates to a website. It is parth of the solution, but not the complete one. Security has to be performed in depth.

TLDR;

So can it help build trust? Well the user will know his username and password can't be sniffed, but if your application is coded badly and you use admin:admin as server login then there are other, easier attack vectors which attackers may abuse to gain access to your user's data. But most of all this will largely depend on the awareness of the user.

share|improve this answer

SSL or https has a reputation in the market, i.e. end users will trust the website more, definitely but that's not the only area which will need to be secured obviously. But yes, it will definitely enhance some confidence among your tech savvy clients.

SSL offers non-repudiation, confidentiality and integrity. Confidentiality and integrity may be obvious to you so I'll focus on non-repudiation. Non-repudiation in this case ensures that the website (the sender) cannot deny that it sent the message across, this goes a long way in establishing trust.

Like Lucas said, there are other factors apart from the SSL implementations which govern security but I'd say that SSL is perhaps the most marketable and obvious to the end user. The browsers tell the end user with that green highlights if a website has passed all forms of SSL authentication i.e

  • Certificate date validity
  • Certificate revocation (if the certificate is revoked due to problems with ownership of the cert or if it's an outdated cert)
  • If the issuers (chain of issuers) are trusted by the client
  • Digital signature validation
  • Domain name matching to prevent man in the middle attacks.

Of course SSL only prevents sniffers to intercept and view/modify the data during transmission.

If your users are very tech savvy then may I recommend also adding the HttpOnly and Secure flags as responses. Clients can easily detect that using browser tools and apart from just marketing the security features, it really is an important parameter to enhance your security.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.