>I am trying to explain to him why this is bad, but he doesn't really care.
"You are losing sales. People look for the lock icon on the address bar."
Also, he can get SSL on his site for FREE in < 5 minutes using Cloudflare.
Ask HN: Liability due to lack of SSL
11–20 of 33 posts
Re: Ask HN: Liability due to lack of SSL
#12https://www.ftc.gov/tips-advice/business-center/guidance/sta...
Read section 4 specifically.
Re: Ask HN: Liability due to lack of SSL
#13I would focus his attention on the possibility that his card processor will cut him off for violations of their agreement. This would result in large-scale loss of business and it may not be easy to arrange for a new processor on short notice. Keep his eyes on the money.
I would not bother with a technical explanation of any of this stuff. He doesn't care, and bluntly it's not particularly easy to point to major compromises in which the lack of SSL played a key role. Most of the time, data is siphoned out of "PCI-compliant" shops that do use SSL, and they get it through database compromises and/or compromised POS terminals. MITM doesn't seem to be worth the effort, if only because the other stuff is so easy and yields so much data.
Nor would I bother talking about PCI. Most of their requirements are silly and do little or nothing to prevent exposure of PII or fraud. What matters to him is the agreement with his processor, not some 4000-page document that wants to tell you how to take a piss.
Eyes on the money. No processor, no business, no money. Keep it simple. If that doesn't do it, you've done your part and should walk away. It's not your problem.
Re: Ask HN: Liability due to lack of SSL
#14If a storefront on the web asked me for an SSN, HTTPS or HTTP, I'd probably file a police report for the attempted identity theft. There's literally no other plausible reason to collect that information, unless he/she is a registered financial institution extending credit to people.
Re: Ask HN: Liability due to lack of SSL
#15The first thing I'd think of with a site asking for SSN is an active intent to commit fraud: ID theft, or fraud. That's before SSL (which is obsolete anyway, only TLS should be considered now).
The second thing, the fact it's http and not https suggests he's collecting and storing this information, which is almost certainly a violation of his credit card agreement with his bank. Credit card information is not supposed to be stored, he passes that off through a secure connection with his processing service, who will only do that through a secure connection, and he gets a transaction ID and authorization and that's all he references from that point on.
So this is less about SSL/TLS as it is, he's doing it all wrong. And it's depressing that he's in business, only made possible by the ignorance of his customers who actually agree to give him all of this information, and on an insecure connection no less.
Re: Ask HN: Liability due to lack of SSL
#16I'd say an even bigger question is, why is he even doing it that way at all, and not using a service like Stripe, Braintree, Shopify or similar? They've invested in polished checkout experiences, it's what they do, and it moves the burden of PCI compliance, PII storage, SSL etc to the service. When Stripe exists, why would you even go down the merchant account route anymore?
Scaring them with the bad stuff might not be effective, people don't react well to being told they're doing everything wrong. Perhaps showing them an easier solution that reduces their admin hassles & could potentially increase their sales is a better way to approach this.
Re: Ask HN: Liability due to lack of SSL
#17[deleted]
Re: Ask HN: Liability due to lack of SSL
#18Unless he is a government, insurance, credit card, bank, real estate organization he should not be asking for a SSN online or storing it unless they are for his employees or the transactions being conducted requires notification to the IRS or the transaction is subject to the customer identification program rules. Either way PII like this should be securely stored offline. For Credit Card information it has to all be…
I should clarify that it is for Real Estate, thus the SSN. That link might be helpful.
Re: Ask HN: Liability due to lack of SSL
#19>I am trying to explain to him why this is bad, but he doesn't really care. "You are losing sales. People look for the lock icon on the address bar." Also, he can get SSL on his site for FREE in < 5 minutes using Cloudflare.
Thats a good point. I don't want to open the can of words and add SSL myself, some interesting things to think about for sure.
Re: Ask HN: Liability due to lack of SSL
#20>I am trying to explain to him why this is bad, but he doesn't really care. "You are losing sales. People look for the lock icon on the address bar." Also, he can get SSL on his site for FREE in < 5 minutes using Cloudflare.
Cloudflare may be a good option for him. But, the quick and free Cloudflare SSL would still be non-SSL from Cloudflare to his site – an improvement against many home/public-Wifi threats but not a total fix (nor true compliance with credit-card agreements).
Also, for a totally non-technical person, it will take – and be billed as – more than 5 minutes of someone else's time to get even that free half-measure into effect.