Question about security

**prosys** · Oct 19th, 2003, 06:27 PM

Hi,

I just have finished a site where user can buy stuff from our company's, but now I must add security for the payment (the credit card number for example). I think I need SSL to do it, but I have no idea on how to do it, so if anyone can direct me to somes sites where there examples or sites that explain how ssl work, that would be great

.

Thanks

**phpman** · Oct 20th, 2003, 10:14 PM

your server has to have it installed or enabled and you have to buy a certificate.

ssl is not difficult and you don't really need php to do anything with it.

I wouldn't keep the cc # in anything on the site, let paypal or 2checkout or authorize.net do it. less hassle on your part.

**prosys** · Oct 21st, 2003, 09:24 PM

Thanks,

I will contact my web hoster to enable SSL (has they told me when I buy a package from them that it should support it).

Prosys

**The Hobo** · Oct 21st, 2003, 10:50 PM

Originally posted by phpman
and you have to buy a certificate

Just wondering (as I probably wont ever do it)...how much does this cost? Would you have to update it annually like a subscription? And what do you have to do to prove you're not scamming people?

**phpman** · Oct 21st, 2003, 10:59 PM

I don't know the fine details but yes you have to update it once a year or so. and no it can't be a scam because your brwoser detects the certificate and lets you know if it is out of date or a incorrect certificate.

**The Hobo** · Oct 21st, 2003, 11:03 PM

I meant that when you purchase the certificate, how do they know (the people that sell it to you), that your site is not scamming people and stealing credit card numbers?

**phpman** · Oct 21st, 2003, 11:26 PM

you can't steal creditcard numbers just form a SSL site. well I suppose you could but the certificate doesn't have anything to do with it. you can still go to a https:// site without a certificate and do the samehting, but the user is pretty stupid if they didn't notice a certificate. you can check any SSL site in the browser.

go here
https://www.accountonline.com/View?d...teId=BKCD_WAMU

and in mozilla go to View->page info and go to the security tab. tha twill tell you all you need to know if the certificate is valid and where it came from.

i have never done it myself but the owner of the site I run does it so I don't see it.

**The Hobo** · Oct 22nd, 2003, 03:16 PM

You're still not answering the right question.

How do the people that sell the certificates verify that the site is actually secure? There has to be something to 'secure' other than having a certificate.

**CornedBee** · Oct 22nd, 2003, 04:20 PM

The certificate doesn't tell people that your site is secure, it tells people that the site is what it claims to be, i.e. that no cracker somehow hijacked your IP and tries to lure people into giving out information.
The certificate is akin to an ID card.

**The Hobo** · Oct 22nd, 2003, 04:55 PM

I still don't understand. So all a certificate does is tell people that the site is what it says it is?

**phpman** · Oct 22nd, 2003, 07:44 PM

Hobo, I know wha tyou are asking and I just can't think of the words to really tell you. that site I gave you lets you see the certificate so you can be the judge and jury on whether it is safe. see where teh certificate is authorized from and go there and see what they say.

I just can't think of what to say on your question, sorry.

**kows** · Oct 22nd, 2003, 09:26 PM

I know exactly what Hobo's thinking, because I wonder the same thing. He's basically asking how do the people who supply the certificate know if the buyer is legit or not? I don't really know how they would figure that out, and so I guess I could go buy a certificate and scam thousands of people because I'm just a kid that wants money from stupid people. I really thought it was quite simple to understand what he meant, but while I was reading this, no one knew.. or knows.

**phpman** · Oct 22nd, 2003, 09:50 PM

well think of it this way.

if you get a SSL certificate and you use it to demise users and get there CC# then prepare to get sued.

go ahead and do what you want with the CC#'s. but I quote

A single fraud incident can put a merchant out of business

read here as it will answer your questions. like I said in the beginning.

http://www.verisign.com/products/sit...28-bit.html#17

**CornedBee** · Oct 23rd, 2003, 01:15 AM

Ok, I'll try it again.

A certificate by itself doesn't mean that you are doing legal things or that you are in any way to be trusted. The certificate ensures two things:
a) If your page claims to be that of company XYZ then it really is that of company XYZ. This allows the user to decide whether to trust company XYZ, instead of whether to trust a website that claims to be that of company XYZ. The certificate gives a trusted link between a website and its owner.
b) Your page will not get hijacked. It is sometimes possible to redirect all requests to an IP to another IP, or the DNS server that stores your web address gets hacked and your entry changed so that all requests to www.xyz.com go not to your server but to some other. This server could then provide a mirror of your page and try to lure people into giving out information. But since your server has a certificate and the other not, the browser will warn people about that. People will know when they are on your page. The certificate guarantees that the page you're viewing is the one you think you're viewing.

Fraud is possible. But it is stupid. The two things the certificate does guarantee that it is you who did the fraud, and you'd get sued to hell.

**phpman** · Oct 23rd, 2003, 07:56 AM

and besides all that that link explains that you have to have a business license and the gov'ts aggreement that you are legit.

**The Hobo** · Oct 23rd, 2003, 09:58 AM

Originally posted by phpman
read here as it will answer your questions. like I said in the beginning.

http://www.verisign.com/products/sit...28-bit.html#17

No you didn't. Where?

**phpman** · Oct 23rd, 2003, 04:21 PM

Originally posted by phpman
you can't steal creditcard numbers just form a SSL site. well I suppose you could but the certificate doesn't have anything to do with it. you can still go to a https:// site without a certificate and do the samehting, but the user is pretty stupid if they didn't notice a certificate. you can check any SSL site in the browser.

go here
https://www.accountonline.com/View?d...teId=BKCD_WAMU

and in mozilla go to View->page info and go to the security tab. tha twill tell you all you need to know if the certificate is valid and where it came from.

i have never done it myself but the owner of the site I run does it so I don't see it.

if you would have done what I asked you to do you could find out all that info. I did it and found out where they bought that certificate and searched. just takes initiative

**The Hobo** · Oct 23rd, 2003, 09:55 PM

If I wanted to find the answer on my own, I wouldn't be asking questions here.

Thread: Question about security

Thread Tools

Display

Question about security

Posting Permissions