1

I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any authentication mechanism implemented, you can't create an account on the website. It only allows you to browse for products and add items to a shopping basket. The shopping basket section displays the total price of your items and also provides a way to calculate your shipping costs based on your country and zip/post code. All this information is not encrypted as the entire website uses plaintext HTTP.

I can't enter payment information on the website and complete my checkout process. The website has only one method of payment - 'Pay with Paypal'.

As soon as I click the 'Pay with Paypal' button I get redirected to the secure PayPal website where I can login and make a purchase. Note: I haven't actually tried to login into PayPal as I was worried that login/checkout information would be somehow returned to the main HTTP website unencrypted at a later stage. I also don't know if I make a purchase via PayPal, the checkout and the transaction stages will be completed on the PayPal website rather than on the main HTTP website.

The question I have is as follows:

Would it be safe for me to purchase items on that website given the fact that no sensitive information (apart from the total cost of items in the shopping basket and shipping costs) is stored on the website, and the entire checkout process seems to happen only on the secure PayPal website (not 100% sure though as I haven't actually made a purchase via PayPal yet)?

Would you purchase a product on such a website and pay with PayPal without worrying that your information could be compromised by a man-in-the-middle attacker?

Improve this question
3
  • 1
    What you describe so far does not show any real problems, i.e. no real sensitive information where transferred using plain HTTP. It would be interesting though how the site continues after they Paypal payment, i.e. if personal information are transferred using plain HTTP. Only, you did not continue with the checkout so it is impossible to say.
    – Steffen Ullrich
    Commented Jun 25, 2018 at 16:44
  • That's a very good point, it's hard to be 100% sure until I actually attempt to purchase something. I might get a prepaid card, link it to a new PayPal account and then purchase a product
    – Alex
    Commented Jun 25, 2018 at 20:19
  • I guess you don't consider the shipping info 'sensitive information'. However, from the shop POV, this is PII and they should implement https...
    – Ángel
    Commented Jun 26, 2018 at 0:19

2 Answers 2

Reset to default
1

Unless you are actually entering the sensitive information (i.e., credit card info) on the site itself, then you are fine. Think about it this way, say you're on the street, just outside of a bank. Everyone can see where you are, what you are doing, etc,. However, to make a transaction, you now go into some random transaction office in the bank. Clearly, no one on the street can actually see what you are doing, or even your exact location anymore. You complete the transaction, then come back and walk on the street, having completed your transaction. No one on the outside saw anything. Now of course some of the people on street might suspect that you just completed a transaction at the bank and target you for it, but unless you took the sensitive information with you to the street, then they won't be able to find anything. The street in this case is the random HTTP website that you are on, and the bank is PayPal.

Improve this answer
3
  • Thank you for providing such a clear example, it all makes sense now. Good point on the last part, unless I take the sensitive information with me back to the HTTP website, my data should be safe with Paypal. I just don't know if the sensitive information will be returned to the HTTP site after I make a purchase, since I haven't tried buying anything yet. The only way to find out is to obviously buy something.
    – Alex
    Commented Jun 25, 2018 at 20:30
  • The sensitive information itself will not be accessible. The only possible scenario is what Thorium mentioned above, and even though it is possible, I'd argue you're more likely to get struck by lightning!
    – mertmumtaz
    Commented Jun 25, 2018 at 20:48
  • haha, that's a relief!
    – Alex
    Commented Jun 25, 2018 at 20:50
1

What you describe is how most e-commerce sites worked on the last decade, when SSL certificates where complicated and expensive.

This kind of site does not process payments on their own, but delegate to a trusted third party, like PayPal, Alipay or other payment gateway. In this case, no financial data is stored on their systems, but only the delivery details: products and quantities, user name and address, and so on. It reduces the complexity and the amount of data they have to keep safe.

In this case, the shop will generate a transaction id and value and redirect you to PayPal, which will ask you for payment details, and if the transaction is successful, will redirect you back to merchant site.

There are a very small risk that someone detected you were paying something on this site, and alter the transaction id to another one, so you would pay for his transaction. You would surely see on the confirmation page that your name and address are different and could call the site to revert the payment. But I seriously doubt anyone would be able to execute this kind of attack.

Improve this answer
3
  • Thank you for your explanation. Yes, I do remember e-commerce sites used to work like that years ago. Too bad the developers of this site haven't enforced HTTPS across the entire web application. You've made a good point on the transaction id alteration. I'm very tempted to purchase an item and see what happens after I pay with Paypal. Will probably use a prepaid credit/debit card for that.
    – Alex
    Commented Jun 25, 2018 at 20:27
  • You don't have to worry. It's very unlikely someone could change the transaction ID. They would have to poison your ARP cache, create a transaction for the same price beforehand, put themselves between you and the gateway and change the transaction on-fly. For what? A couple t-shirts?
    – ThoriumBR
    Commented Jun 25, 2018 at 20:30
  • Yeah, and the chances of all these things to happen at once over the Internet are almost non-existent. As long as the entire checkout and transaction process happens on the PayPal website and my payment information is never returned to the main HTTP website upon completion of my purchase, I should be safe.
    – Alex
    Commented Jun 25, 2018 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .