We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be .

The concern for me is that our Portal application does not use HTTPS leaving it susceptible to MITM attacks but since the payment gateway uses SSL , are we still open to MITM attacks? What are the other risks involved ?

Based on the suggestions here , I will try to convince our client to buy a digital certificate from a registering certifying authority if it is needed .

  • There is no reason for you to not have SSL. It's less than $10 yearly. – user43488 Jul 3 '14 at 7:12

It's often not only the case that "payment information" is the only sensitive information. If your portal requires some sort of "login" (which it undoubtedly does), you allow many parties in between (Internet Cafe owners, ISP's, "hackers", employers, govermenments, ...) to see these credentials and take over the account.

If your portal has anything in terms of recurring payment what they can setup from your unsecured side, or any requests that would affect the subjects account, you offer no protection towards that.

SSL certificates and the benefits they offer (even if it's just a professional and trusted image) far outweigh the cheap price.


This is an assumption, but presumably your site is for the most part HTTP, then when it needs to process a payment it becomes HTTPS or forwards to a HTTPS page?

If so there is a risk there, as it is possible to fool users into visiting a HTTPS page over only HTTP. For example see http://www.thoughtcrime.org/software/sslstrip/.

As m1ke alludes to, you can have parties in between your client and server, eg coffee shop. In this scenario it is perfectly plausible for them to do something like an SSL Strip, so your users may not be using SSL for their payment after all.

Not to mention the fact that if you aren't using SSL for the 'main' part of your site, you run the risk of someone creating a malicious replica of it and using it for phishing attacks or to trick users into using the bad version of the site rather than the real version - if this happens the bad guys have complete control of any data the user submits including personal and financial data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.