2

Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier)

The information flow is as such: 1. Session ID set on User browser 2. User selects a book from a list of books and submits it to Server 3. User submits Credit Card information to Server 4. Server displays downloadable book (link is randomly generated and temporary)

Improve this question
2
  • 3
    How does the server's public key get to the client (Or vice versa)?
    – user2675345
    Commented Apr 1, 2014 at 17:08
  • 3
    How does the client validate the server's PGP key? Without a trusted authority, a man in the middle could sit between the client and server and substitute his own PGP keys for yours to intercept traffic.
    – Johnny
    Commented Apr 2, 2014 at 0:34

1 Answer 1

Reset to default
2

The main problem you find is with the validation of information, without validate the server's PGP key you can not confirm the integrity nor the confidentiality of your information.

What could happen:

Server: sends the public key to the client;

Man-in-the-middle: Receive the public key, and send his own public key to the victim;

Victim: Receives the attacker public key;

When server sends information to victim, the attacker would simple read, or change it, and then send it to the victim.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .