21–30 of 33 posts
At least it isn't some guys backyard CMS.
So I dived in a bit more while I wait for him to call me back. It's a Magento build using Autorize.net I haven't worked with Magento in years, but should be really simple right. Set up some forwarding rules in Cloudflare to always to go the HTTPS and of course the cert. At least it isn't some guys backyard CMS.
Please do not do that. That doesn't solve the problem at all if the origin server is still serving the content over HTTP. You're just lying to visitors by making them think it's secure when it's really not.
Magento is like any other PHP app.. there's Apache (or some other webserver) in front of it.. so just setup Apache properly.
>I am trying to explain to him why this is bad, but he doesn't really care. "You are losing sales. People look for the lock icon on the address bar." Also, he can get SSL on his site for FREE in < 5 minutes using Cloudflare.
Cloudflare may be a good option for him. But, the quick and free Cloudflare SSL would still be non-SSL from Cloudflare to his site – an improvement against many home/public-Wifi threats but not a total fix (nor true compliance with credit-card agreements). Also, for a totally non-technical person, it will take – and be billed as – more than 5 minutes of someone else's time to get even that free half-measure into effe…
That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server is actually encrypted? I can't think of a way to do this unless you know the address of the true IP of the destination and poke it on the SSL port. That still doesn't guarantee SSL is being used, though.
I'd say an even bigger question is, why is he even doing it that way at all, and not using a service like Stripe, Braintree, Shopify or similar? They've invested in polished checkout experiences, it's what they do, and it moves the burden of PCI compliance, PII storage, SSL etc to the service. When Stripe exists, why would you even go down the merchant account route anymore? Scaring them with the bad stuff might not…
Earlier quoted context omitted.
Cloudflare may be a good option for him. But, the quick and free Cloudflare SSL would still be non-SSL from Cloudflare to his site – an improvement against many home/public-Wifi threats but not a total fix (nor true compliance with credit-card agreements). Also, for a totally non-technical person, it will take – and be billed as – more than 5 minutes of someone else's time to get even that free half-measure into effe…
Good points. That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server is actually encrypted? I can't think of a way to do this unless you know the address of the true IP of the destination and poke it on the SSL port. That still doesn't guarantee SSL is being used, though.
In my opinion best practice would be to obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare. (I don't know if Cloudflare offers any options for this stronger than trusting their IP ranges, such as a client certificate on their outbound-SSL.) So if you could "poke [the true origin] on the SSL port", that could itself be evidence of suboptimal security.
Earlier quoted context omitted.
Can someone explain how identity theft is even possible in the US? I hear a lot about it, but I can't understand how broken a system must be that makes it possible for someone to steal your identity just by having one identifier.
Hypothetical situation: what do you do if you lose all of your ID (e.g. house fire)? You have to start somewhere, and your SSN is a good choice. You can't do it solely based on one single number, but in this case a data breach would include name, address, credit card number, SSN, and probably security questions. You can turn around and use that information to play the part of a person to another organization, and the…
It should never be possible to do what you're suggesting, not unless the USA is failing to collect that info in the first place.
Earlier quoted context omitted.
Can someone explain how identity theft is even possible in the US? I hear a lot about it, but I can't understand how broken a system must be that makes it possible for someone to steal your identity just by having one identifier.
That's the problem, it really is that easy. All it takes is someone to know you SSN and, depending on what they are trying to do, a little bit of information about you. SSN numbers were originally only supposed to be used as a government identifier for social security, however, they have evolved into a unique identifier for all US citizens. They are used in every facet of the banking/credit industry here and are reli…
We have our national ID number uniquely identifying us, our VAT record number as well, but neither is secret (companies will ask them for verification, or to issue an invoice for purchases for the latter). There's no identity theft I know of, as you have to show your ID to do anything sensitive anywhere.
Earlier quoted context omitted.
Can someone explain how identity theft is even possible in the US? I hear a lot about it, but I can't understand how broken a system must be that makes it possible for someone to steal your identity just by having one identifier.
Hypothetical situation: what do you do if you lose all of your ID (e.g. house fire)? You have to start somewhere, and your SSN is a good choice. You can't do it solely based on one single number, but in this case a data breach would include name, address, credit card number, SSN, and probably security questions. You can turn around and use that information to play the part of a person to another organization, and the…
Earlier quoted context omitted.
Good points. That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server is actually encrypted? I can't think of a way to do this unless you know the address of the true IP of the destination and poke it on the SSL port. That still doesn't guarantee SSL is being used, though.
In general there's no way to know: you have to trust the destination's internal choices, once you've reached their chosen perimeter. In my opinion best practice would be to obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare. (I don't know if Cloudflare offers any options for this stronger than trusting their IP ranges, such as a client certificate on their outbound-SSL.)…
This is what I was planning to do when I launch the app I'm working on now. Thanks for the reply.