In one of our websites, there is a link pointing to a page to download some PDF files. Visitors have to submit their their name, job title, company, phone number and e-mail address and click a 'submit' button before landing at the page where the PDF file is hosted. However, the page where it collects name, e-mail address etc are not served through HTTPS. Personally, I think that any page that collects PII should be served through HTTPS, but I need something to present to the management before making this change (from HTTP to HTTPS). Does the practice of collecting the above details through a non-HTTPS page violates our policy if we are committed to protect PII of our customers and visitors?

  • 1
    Strictly speaking only the actual transfer of the form data should be protected by HTTPS, not the page on which you are filing in the boxes, but it has become common practice to use HTTPS for both as a visual indication "we are handling this safely."
    – user13695
    Apr 4 '17 at 7:54
  • It would be worth checking data protection laws for your location, most countries will have regulations that set out protection of personal information. They obviously won't stipulate technical measures such as https but they may give you some ammunition for your argument. I believe you are right, any submission of PII should be over HTTPS and for every piece of PII you should consider at-rest encryption.
    – iainpb
    Apr 4 '17 at 8:02
  • 1
    If your company is based in the E.U., you can possibly summon GDPR to convince management. The "we have to follow the law" argument usually has a great impact and is difficult to avoid in a meeting attended by more than 2 employees :) An argument like "because it is Good" becomes "because we could get fined", if money is all what they care about.
    – niilzon
    Apr 4 '17 at 11:06
  • people around here will probably tell you to use https for everything
    – dandavis
    Apr 4 '17 at 18:12
  • @Jan If you don't protect the page that contains the form, it can be modified to send the data to an attacker's server. Apr 4 '17 at 18:55

Personal information (PII) Must be protected.

Name and emails are. IP address can be too.

If it's in your policy, you have to.

In Europe, it's an obligation, like in most countries.

So you must use https.

If you don't use https on all your pages including ones without PII, then you are vulnerable to MitM/sslstrip attacks, so you don't protect them correctly.

You should use https on all your pages and HSTS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.