3

There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required.

When registering Firefox alerted me that the site was only HTTP, so I tried prefixing https:// and the page doesn't exist. I contacted the site administrator to ask them and they said:

appropriate security measures have been provided to guarantee the personal data security. As for the SSL certificate (recommended by the GDPR), we will provide with this one as soon as possible.

I know very little about security, so I am hoping someone could tell me whether what they are saying holds water and it could be a secure site that has yet to use a SSL certificate (it seems unlikely if they are only using HTTP)

If the statement doesn't hold water, and the administrator agrees to it, is there a way that I can package and send the data to them securely by alternative means?

7
  • 1
    I think your last question makes this a bit too broad and distracts from the more important question - whether or not this is private. Regardless, I wouldn't expect any real options there. Stuff like this happens regularly. SSL certificates have been easy to provide and even free for years now. There is no reason for a company to not secure sensitive data with an SSL certificate these days. That is a sign of either a complete lack of concern, or total incompetence. In either case don't expect them to take your concerns seriously or offer alternatives. Jan 9 '20 at 14:41
  • For reading: bisongrid.uk/blog/… Jan 9 '20 at 14:43
  • I removed the part about potentially sharing the url of the company in question, not because I think you shouldn't, but simply because it isn't relevant to the question. Sometimes "name and shame" can be an effective strategy, so if you want to edit your question to provide a link in your post, I (personally) think that's a perfectly reasonable thing to do. Jan 9 '20 at 15:14
  • Assuming you're based in the UK, you may wish to file a complaint with ico.org.uk who are UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. Any company that processes personal information of UK citizens are required by law to pay the ICO a fee as well as meet conditions to secure the data and protect their customer's privacy.
    – HTLee
    Jan 9 '20 at 15:35
  • 1
    For reference, here's the Italian equivalent of the ICO who may be able to help with this.
    – Tom Revell
    Jan 10 '20 at 13:06
4

tl/dr: This company has no idea what they are doing. If you want to protect your data, the only option is to refuse to do business with them.

Privacy and HTTP

The first question is whether or not it is possible to communicate privately over HTTP. The answer is generally a solid "NO!". HTTP is a plain text protocol, which means that every server in between your machine and the destination server has an opportunity to read, log, and do whatever it wants with any data transmitted over HTTP. This is not a theoretical problem - there can easily be dozens of servers and switches between you and the destination.

Now technically it is possible for a website to perform its own encryption before transmitting data over HTTP, thus providing privacy anyway. In practice though it is safe to assume that this is not happening. The reason is because doing this (and more importantly, doing it well) is quite difficult. Using an SSL certificate over HTTPS is a much simpler, quicker, and cheaper way of providing privacy over the internet. It would be absolutely crazy to forgo HTTPS and instead attempt your own encryption over HTTP, especially since there are large parts of the HTTP request that you still wouldn't be able to encrypt anyway. It wouldn't be a private solution even if you tried.

HTTPS

So to reiterate, HTTPS is the simplest and most effective way to communicate privately over the internet. Especially since the advent of Let's Encrypt, it's also incredibly easy to implement and free. There is literally no good reason for a website operator to skip HTTPS on any website that collects sensitive data. It's really as simple as that.

The company response

So what about this company? They don't have HTTPS. They are transmitting your data over HTTP. I can guarantee you that they aren't trying to encrypt it otherwise, and that really wouldn't work well even if they tried. That means that your private data is being sent across the internet for everyone to see. However, they say:

appropriate security measures have been provided to guarantee the personal data security

Quite simply, this is complete B.S. All this means is that they believe that their security measures are appropriate. The lack of HTTPS conclusively demonstrates otherwise. They dig the hole further on the next line:

we will provide [an SSL certificate] as soon as possible.

As we've already discussed, SSL certificates are free and easy to install. "As soon as possible" happened literally 4 years ago. This is nothing but an excuse for incompetence, which leaves your data at risk.

Finally you ask:

is there a way that I can package and send the data to them securely by alternative means

Unfortunately you are asking the wrong question. Imagine that you do come up with some way to securely send them data. When a company has failed so completely with the basics of data security, can you really expect them to store and use your data in a secure and private manner?

You should simply assume that whatever information you send to them, regardless of how it gets there, will eventually be leaked publicly. Because it probably will.

Next steps?

In the end you have to decide which you care about more: the possibility of getting a job from them or the possibility of having your private data leaked. Only you can make that call.

They mentioned GDPR, so presumably they are in a region where the GDPR is in force. Presumably they are violating GDPR, despite their claims otherwise. This suggests that an obvious next step is to file a complaint with the proper government organization. I'm in the USA so I have no idea what that entails (and it is more of a legal matter anyway, so not really on-topic here). Regardless, that is unlikely to make change happen on a timescale you need it to happen, so once again you will have to decide between using them and risking your data, or ignoring them and risking the loss of a job opportunity.

4
  • They are an international internship portal who I believe are affiliated with the EU government, so I think that it is kind of... wierd that they don't adhere to GDPR guidelines. It does say on your link that GDPR doesn't directly stipulate that SSL is required, but that data controllers are responsible for data integrity, so they aren't in violation as such but it is very negligent. Jan 9 '20 at 15:29
  • @ScottAnderson Again, that's a bit of a legal question. A GDPR authority may feel differently about the situation. This sounds more like the sort of situation where they are not trying to stipulate specific technologies so companies have more latitude to find the best solution. A company who uses that latitude as an excuse to not do anything may still find themselves in legal trouble, even if they haven't technically violated the rules. Again though, I'm neither a lawyer nor under the GDPR umbrella, so I really don't know. Jan 9 '20 at 15:31
  • @ScottAnderson You could try asking that question on law.stackexchange.com to see what everyone there thinks: "Is it a violation of GDPR for a website that collects personal data to not use an SSL certificate?" Jan 9 '20 at 15:32
  • 1
    This may be already be covered (e.g., by law.stackexchange.com/q/28252/10281 )
    – Brian
    Jan 15 '20 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.