1

This question already has an answer here:

I am relatively new to the world of cryptography and was wanting to develop a webpage which allows credit card payments. Thus, I looked into the digicert ssl service, hoping that it could do what I want.

My question is, if an asymmetric encryption requires some form of exchange and protocol between the server and end-user, then is that not potentially a point of weakness? How does it, if it does, manage to tell each other what cipher and keys to use initially without someone listening in the middle during the handshake process knowing. Ultimately, does it even matter?

Scenario 1: A customer connects to the website. Is it possible that a hijacker poses as the server IP and intercepts the signal, before returning it again unchanged? He becomes a spy in the network...

Scenario 2: Assuming scenario 1 is possible or the electrical cable to the exchange from the customer's home has been compromised, the user computer will tell the server his capabilities and the server will return with a unique response, then the encryption begins. How is that initial process protected? It's sort of like typing a password but someone's watching over your back...

I'm pretty new to this, so this is my understanding. Please correct me at any stages and enlighten me with info.

Thanks in advance.

marked as duplicate by Mark, Xander, TildalWave, AJ Henderson, schroeder Oct 25 '14 at 18:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 6
    If you're a beginner, don't send any credit card data to your server. Send it to a tokenizing PSP. Your server will still need to use SSL, but it avoids a lot of difficulties. – CodesInChaos Oct 24 '14 at 8:19
  • "before returning it" to the client "unchanged" or "before returning it" to the network "unchanged"? – user49075 Oct 24 '14 at 8:27
  • 1
    While agreeing that you shouldn't be collecting credit card data without a much better understanding of SSL, the missing link you're looking for is that SSL certificates have to be signed by a trusted third party whose public key is distributed with the web browser, and so never passes over the Internet where it could be intercepted. In theory, this prevents site spoofing and man-in-the-middle attacks. – Mike Scott Oct 24 '14 at 9:44
  • 1
    It sounds like you should read up on the basics of SSL. security.stackexchange.com/questions/20803/… would be a good starting point. – Mark Oct 24 '14 at 10:23