Ask HN: Liability due to lack of SSL • Hacker News Board

Re: Ask HN: Liability due to lack of SSL

#31

Post by schrodinger » Sun, Aug 09, 2015, 4:01 PM UTC

Filligree wrote: post #27

danudey wrote: post #6

Earlier quoted context omitted.

Hypothetical situation: what do you do if you lose all of your ID (e.g. house fire)? You have to start somewhere, and your SSN is a good choice. You can't do it solely based on one single number, but in this case a data breach would include name, address, credit card number, SSN, and probably security questions. You can turn around and use that information to play the part of a person to another organization, and the…

Well, sure, but the government's information on you will also include... parents, other family, a photograph of your face, and so on. It should never be possible to do what you're suggesting, not unless the USA is failing to collect that info in the first place.

stolen identity doesn't usually mean that someone has convinced a government office that they are you, that would be a lot harder for the reasons you say. It's more often someone having enough information to open a credit card in your name and start using it, or take out a loan—things for which the government is not really involved.

Re: Ask HN: Liability due to lack of SSL

#32

Post by jordsmi » Sun, Aug 09, 2015, 6:46 PM UTC

jtdowney wrote: post #25

SyneRyder wrote: post #16

I'd say an even bigger question is, why is he even doing it that way at all, and not using a service like Stripe, Braintree, Shopify or similar? They've invested in polished checkout experiences, it's what they do, and it moves the burden of PCI compliance, PII storage, SSL etc to the service. When Stripe exists, why would you even go down the merchant account route anymore? Scaring them with the bad stuff might not…

Both Stripe and Braintree require you to use SSL (really TLS) on your checkout pages. They also both require you maintain PCI compliance (although you likely qualify for a reduce set of requirements).

They 'require' it, but it is still possible to use the service without SSL. At least it was possible on stripe a few months ago. I'm not sure if they end up cutting you off after they notice the non ssl traffic, but I setup some test apps that worked fine without ssl.

Re: Ask HN: Liability due to lack of SSL

#33

Post by florin5255 » Tue, Aug 11, 2015, 12:42 PM UTC

HTTP has always been seen as suspicious in case of any transmission of financial or confidential information. Particularly when you are selling product online, then there should be an SSL security to encrypt the details that customers enter on your website. If there is no SSL, hackers can sniff the ongoing data transfer and can steal confidential information on your website. Keeping your customer’s information on your website in a plain text is really dangerous in today’s world.

Once you are hacked, you will hardly able to get your business reliability and as a result, customers will not trust anymore of your site. You will lose prestige among your competitors as well decease profit too.

Besides, always take the necessary information from customers like email address, password, residing address, mobile number, etc. it is not necessary to take SSN number of any customer dealing with your website. If your site has no SSL and you are taking a SSN number, it could create such an awful situation at the time of hacking. As you are smart enough that once you get SSN number of any person, you can dig deep into a person’s profile.

So it is sensible to avert data sniffing, phishing attack or some nefarious action, by installing an SSL certificate on your website as it will enhance the trust of visitors and customers on your website. Learn why you need an SSL certificate and what kind of information it can protect from snooping eyes. - https://www.ssl2buy.com/wiki/do-i-need-an-ssl-certificate/