3

I was going to make a purchase on a website, but the page containing the credit card entry form is served via HTTP and not HTTPS. Is it definitely unsafe?

The website advertises the use of "RapidSSL", but if I send my credit card number through HTTP, this SSL connection will not be used. Is pressing Next on this page a security concern?

no https

10

Checked it now: CC details are really sent UNENCRYPTED over the wire. They use no SSL at all. Not even on POST. The credit card details are really sent over the clear, over the wire. The RapidSSL button is even false, because it does not popup a validation when clicked (which real RapidSSL buttons should do)

I also checked. They have a SSL site with real certificate and Everything, but they specifically disable SSL by redirecting to HTTP when attempting to load the /secure namespace over HTTPS. It should really be the opposite, where HTTP redirects to HTTPS.

I would say you can be sure about submitting a CC number there, and thats only in this specifically case: If you are 100 % sure that your WHOLE PATH, from your computer, to that company's server, is completely trusted, then you can submit the CC there. That includes trusting your ISP, your landlord and every router and device on the path to the Company in question.


How to check yourself:

Check the source of the page. If the credit card form "form action=" parameter Point to a HTTPS site, its encrypted.

If the "form action=" parameter is empty or contains a invalid value, chances are the CC is submitted over a AJAX script and thus you have to rummage through tons of JS code to find out if CC are sent encrypted or not.

However, submitting to a HTTPS site from a HTTP site is NOT 100% SAFE. There is possible that the page in question has been modified in transit by a malicious indivual to send the details to a attacker's server or via a HTTP Connection to be able to sniff the data.

However, MITM/modifying attacks are rare, if you are home on your home Connection and you DO NOT sit on wireless, its pretty hard to get into a suitable position to be able to modify data in transit.

I would say: As long as the form submits to a HTTPS resource (form action=https://blaahblaahblaah) you can be SUFFICIENT safe that the credit card is not being leaked.

If we take the assumption that there only PASSIVE listernes, no Active adversiaries in the network, then your credit card number is 100% safe if the form is sent over HTTPS. However, this are NOT in case here, thus you should really trust the link Before sending anything there. Not even your home Connection may be fully 100% safe to send CC details there, if you account in the physical security of EVERY node on the path.

8

Under no circumstances is it safe to send a credit card number over a connection that is not secured. There are two reasons. The first is that you cannot know whether the path between you and the server is safe; the path can change from day to day, and even form minute to minute.

The more important reason is that the merchant who fails to secure their web transactions may have other bad habits. I don't mean to imply that they're dishonest; only that they either do not understand security or do not care about it. I'm not sure which is worse! So there may very well be other problems of which you are not yet aware.

If you must buy something from this site, check whether your credit card company offers one-time-use numbers, or pick up a prepaid card with just enough to complete the transaction. (Note: is it sometimes hard to spend the last few bucks on a prepaid card. Also, it may be harder to dispute a charge on a prepaid card. The one-shot number is the way to go if possible)

  • There is also Another thing to consider: Theres one thing that theres a teoretical risk that there is a sniffer or listerer somewhere, but Another consideration whenever there is a practical risk. Considering that the physical security of core ISP Cables are pretty high with direct alarms and such, and local Exchanges like ADSL lines and fiber lines to apartments are often in secured and alarmed closets, you can still take the risk. The big risk you are taking is that there MIGHT be a sniffer somewhere, that you dont notice, and then 2 years later the card number is misused, leaving you – sebastian nielsen Dec 31 '14 at 5:27
  • Clueless. The small risk you take is that there is propably not a sniffer in your path. If the data WOULD be sent over a HTTPS Connection but over a form loaded over HTTP, the risk of being subdued would be absolute minimal. In this case theres no HTTPS at all, so the risk is bigger. So what I would say: Its not a big deal if you are only doing a one time purchase. But dont get used of it, you might stumble on a sniffer without knowing. However, doing this on a WIFI Connection or a public space like cyber cafe or whatever, is basically suicide in the security market. If you must buy from this – sebastian nielsen Dec 31 '14 at 5:29
  • site, ONLY do it from a Connection in your home, that you are fairly Confident its a secure path to your ISP, and no part of path ever should be go over powerline Communication, bluetooth or Wifi Communication (not even a wifi Cable extender). – sebastian nielsen Dec 31 '14 at 5:34
  • 2
    @sebastiannielsen: I stand by my answer. Under no circumstances should one transmit sensitive information over a connection that's not encrypted. You talk about "theoretical" risks, but every time we turn around we find another "theoretical" risk has been realized. Ans, as I hove already written, the merchant who fails to secure their web transactions may have other bad habits. – Bob Brown Dec 31 '14 at 8:40
  • Security is about who you trust. If you trust the path, you can send unsecurely. If you are in home, and the path from your location to your destination is secured, then you can be Confident in that nothing is leaked. For example, here where I live, the Connection goes a fiber line directly from my apartment, via a alarmed and locked closet with access Control reader, that my landlord have the access card to, to a Another similar closet, and then it goes directly to a secured POP at the network owner (iTux Future Broadband Inc.). This goes then to my ISP, and then out of backbone. – sebastian nielsen Jan 2 '15 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.