Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier)

The information flow is as such: 1. Session ID set on User browser 2. User selects a book from a list of books and submits it to Server 3. User submits Credit Card information to Server 4. Server displays downloadable book (link is randomly generated and temporary)

  • 3
    How does the server's public key get to the client (Or vice versa)? – user2675345 Apr 1 '14 at 17:08
  • 3
    How does the client validate the server's PGP key? Without a trusted authority, a man in the middle could sit between the client and server and substitute his own PGP keys for yours to intercept traffic. – Johnny Apr 2 '14 at 0:34

The main problem you find is with the validation of information, without validate the server's PGP key you can not confirm the integrity nor the confidentiality of your information.

What could happen:

Server: sends the public key to the client;

Man-in-the-middle: Receive the public key, and send his own public key to the victim;

Victim: Receives the attacker public key;

When server sends information to victim, the attacker would simple read, or change it, and then send it to the victim.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.