1

Suppose I do an online shopping they are asking me to enter my card details like four digit number(whatever related to that) and they are asking me to enter the PIN number too.

If I enter all this things, Can't they get all keystroke from me through Javascript and crack my passwords, card details etc ?

I surfed for safety tips on online shopping, few article suggest to check whether it is a secured session layer supported website Means SSL, Here I have one more doubt SSL is used for Secure Transaction Between Client Browser and server so there won't be any intruder to pretend to me or some attack, what if the server person itself capture this details and make a duplicate card or something and they get all money etc?

If I use money transfer from other service like for example (paypal,stripe) then it is completely fine because they use OAuth but What if it is for internet banking? I'll be shopping through my bank account. Shop Website server can crack my passwords etc right?

Improve this question
2
  • if you enter the details on their page then they can access those details, if you are redirected to your bank's site then only the bank can access it and the bank sends a security token
    – ratchet freak
    Commented Jul 20, 2014 at 13:54
  • If you enter the details on their page then they can access them in any case. It doesn't matter if they later redirect you to your bank's website, in 99% of websites it's still in their own web forms that you typed your card number. That's when you know you want to use Paypal: it requires a redirection to their website before you type any secret information.
    – Steve Dodier-Lazaro
    Commented Jul 20, 2014 at 15:05

2 Answers 2

Reset to default
3

I think you might be mixing a couple of risks up here.

If you are surfing a site and purchasing goods from them, then they will inevitably have access to any data you enter into their site. This would include the username/password that they use on the site and likely any payment card details that you use to pay for things on their site. This is because that data needs to be transferred to them to complete the transaction (no JavaScript needed)

As you say if they use a 3rd party site (e.g. paypal) to process the payment they your credentials for the payment site shouldn't be accessible by the shopping site, although it's here that if they were malicious they could try do something like redirect you to a site which looks like Paypal but isn't...

In terms of accessing your banking details, again, as long as you're not using the same credentials on the banking site as on the shopping site, they shouldn't be able to access your banking credentials.

Improve this answer
2
  • Thanks for the answer. So I should not do shopping if there is no OAuth. If they ask all details from their own site itself then i should shop from that website am i clear?
    – rram
    Commented Jul 20, 2014 at 18:26
  • 1
    rram - not necessarily. It all comes down to how much you trust the shopping site, payment site, infrastructure etc.
    – Rory Alsop ♦
    Commented Jul 21, 2014 at 15:13
1

SSL not only ensures that the transaction is ciphered. It also verifies the identity of the website you are visiting. So, if this is a known website, stealing your confidential information wouldn't be that smart for their reputation.

Just type this kind of confidential information on websites you trust using HTTPS protocol (also make sure its identity is verfied).

By the way, you can also audit the JS code to make sure there is no keylogger, and monitor the requests sent by your browser to know which piece of information is sent to what server.

Improve this answer
2
  • Thanks. Audit the JS code and Request sent are extra work to us while shopping. By the way if there is something made by ssl certified website then we can easily catch them using the registered address, is thats what are you saying, will that be a plus point?
    – rram
    Commented Jul 20, 2014 at 18:30
  • Security is a matter of trust. The client side of a website can be audited by anybody. So I won't fear any popular website for key logging or malicious actions. Well, not actually, however I would first be aware of the web browser (including plugins) and the operating system. Especially if it is proprietary software... I'm sorry I don't understand what you mean "we can easily catch them using the registered address".
    – Antoine Pinsard
    Commented Jul 20, 2014 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .