3

I understand what an SSL certificate does but I need help evaluating if I need one for my client's website.

His website sells holiday packages online but does so without asking for any credit card information. When the visitor tries to book a package, he is sent to a bank's third party gateway where he submits his information and then returns to the website once the payment is complete.

In this scenario, are there any compelling reasons to install an SSL certificate, other than reasons of protecting the brand, and providing a safe atmosphere for visitors to shop?

6

I'm going to interpret this questions as "should SSL be enabled on this client's web server or not?" Regardless of credit card information it is still going to be collecting personal data on the client's customers, and therefore SSL should be enabled. Besides protecting the brand and providing a safe site to shop:

  • It will help protect the client from liability
  • It may be required by laws or regulations depending on where the site is hosted, or the clients it serves
  • It's easier and cheaper to prevent data breaches than clean them up later
  • Great an concise response. I would like to clarify that there is not a normative that obliges you to encipher the traffic, but doing do is something most security experts recommend and in a not very distant future we will find strict regulations about this. – kiBytes Jan 21 '14 at 14:22
  • 1
    Like I said it depends on where you are and what business you are in. You're certainly right that a holiday package site isn't likely to fall into these but it pays to check. Also as you say that can change. – GdD Jan 21 '14 at 14:27
5

One way to look at the problem is the following: why would you not want to use SSL ? The overhead is slight, and the price of the certificate is inconsequential for a business. Maybe, instead of searching for reasons to use SSL, we should apply it unless there is a known, explicit reason why we should not.

Anyway, for your specific situation and with the attacker's point of view: a non-SSL Web site is "safe" as long as the protected payment portal includes an explicit description of what the customer is buying. The customer must see, through the SSL Web page, an unambiguous description of what he is paying for. A simple opaque contract reference is not enough, because the customer cannot really know, then, that what he saw over non-SSL Web page is really what the server sent from the other side.

On a general basis, active attackers can spread considerable mayhem on an unprotected Web site: defacement, automatic download of malware into unsuspecting customers' computers,... but this crude vandalism is often detected as such. A much more damaging action would be to only insert subtle alterations in the Web site functioning. If the customer buys a package and discovers only upon landing in a remote sunny island that, contrary to what he thought, his package did not include the hotel booking, then he will be quite irate; and a subtle attacker can make that unhappy situation happen by altering the non-SSL contents of the Web site. If I wanted to thoroughly crush the business of the holiday-selling Web site of your client, I would do it that way.

Most Web sites avoid attacks by sheer mass effect: there are just not enough attackers around the World to really break all vulnerable sites. That's a rather effective, but heuristic in nature, security protection. Using site-wide SSL is a not very expensive way to lower the dependency on luck.

2

If you are going to use http for your customers to connect with you , there is no way in determining that the data being sent to and fro is actually from who you think it is .

Especially from a customer's point of view , the data being sent to the website from his browser must reach intact and should'nt be available to anybody else on the same network.

MITM & session hijacking are much more easier when you use http . [ Even though they cannot touch the banking information , what about the holiday package related information and more importantly the user's personal information which they will be filling on your website( we don't want it altered on the way or be available to anyone on the network now do we.)]

If i was a customer i would feel comfortable if i see the padlock sign on the url bar when i visit a website which is going to lead me to a monetary transaction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.