1

Suppose I do an online shopping they are asking me to enter my card details like four digit number(whatever related to that) and they are asking me to enter the PIN number too.

If I enter all this things, Can't they get all keystroke from me through Javascript and crack my passwords, card details etc ?

I surfed for safety tips on online shopping, few article suggest to check whether it is a secured session layer supported website Means SSL, Here I have one more doubt SSL is used for Secure Transaction Between Client Browser and server so there won't be any intruder to pretend to me or some attack, what if the server person itself capture this details and make a duplicate card or something and they get all money etc?

If I use money transfer from other service like for example (paypal,stripe) then it is completely fine because they use OAuth but What if it is for internet banking? I'll be shopping through my bank account. Shop Website server can crack my passwords etc right?

  • if you enter the details on their page then they can access those details, if you are redirected to your bank's site then only the bank can access it and the bank sends a security token – ratchet freak Jul 20 '14 at 13:54
  • If you enter the details on their page then they can access them in any case. It doesn't matter if they later redirect you to your bank's website, in 99% of websites it's still in their own web forms that you typed your card number. That's when you know you want to use Paypal: it requires a redirection to their website before you type any secret information. – Steve Dodier-Lazaro Jul 20 '14 at 15:05
3

I think you might be mixing a couple of risks up here.

If you are surfing a site and purchasing goods from them, then they will inevitably have access to any data you enter into their site. This would include the username/password that they use on the site and likely any payment card details that you use to pay for things on their site. This is because that data needs to be transferred to them to complete the transaction (no JavaScript needed)

As you say if they use a 3rd party site (e.g. paypal) to process the payment they your credentials for the payment site shouldn't be accessible by the shopping site, although it's here that if they were malicious they could try do something like redirect you to a site which looks like Paypal but isn't...

In terms of accessing your banking details, again, as long as you're not using the same credentials on the banking site as on the shopping site, they shouldn't be able to access your banking credentials.

  • Thanks for the answer. So I should not do shopping if there is no OAuth. If they ask all details from their own site itself then i should shop from that website am i clear? – rram Jul 20 '14 at 18:26
  • 1
    rram - not necessarily. It all comes down to how much you trust the shopping site, payment site, infrastructure etc. – Rory Alsop Jul 21 '14 at 15:13
1

SSL not only ensures that the transaction is ciphered. It also verifies the identity of the website you are visiting. So, if this is a known website, stealing your confidential information wouldn't be that smart for their reputation.

Just type this kind of confidential information on websites you trust using HTTPS protocol (also make sure its identity is verfied).

By the way, you can also audit the JS code to make sure there is no keylogger, and monitor the requests sent by your browser to know which piece of information is sent to what server.

  • Thanks. Audit the JS code and Request sent are extra work to us while shopping. By the way if there is something made by ssl certified website then we can easily catch them using the registered address, is thats what are you saying, will that be a plus point? – rram Jul 20 '14 at 18:30
  • Security is a matter of trust. The client side of a website can be audited by anybody. So I won't fear any popular website for key logging or malicious actions. Well, not actually, however I would first be aware of the web browser (including plugins) and the operating system. Especially if it is proprietary software... I'm sorry I don't understand what you mean "we can easily catch them using the registered address". – Antoine Pinsard Jul 20 '14 at 19:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.