• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 238
  • Last Modified:

Where does the encryption happen with SSL?

A question about SSL...

When is the information that is sent by https actually encrypted?  If you request https://www.ordersomethingonline.com/ and it's an order form asking for your credit card number and it's sent to http://www.ordersomethingonline.com/cgi-bin/process.cgi (notice the http instead of https on the cgi call) does that mean:

a. The original form is encrypted when it's sent to the user before he fills it out but then what he actually fills out on the form is NOT encrypted when it's sent to the cgi script

or...

b. The content the user types into the form is encrypted when it's sent to the cgi script, but whatever the cgi script echoes back as confirmation is NOT encrypted?
0
rmacmich
Asked:
rmacmich
1 Solution
 
jhurstCommented:
The browser encrypts and dcrypts data just before sending it when the connection is https, and DOES NOT for HTTP.  So, if the submission of the form is to a http-site - your credit card information is being sent in clear text format.

Realistically there is little risk of someone seeing it.  I think the risk is much less than some wait-person making an extra copy of your credit card in a restuarant etc.  

If you note all of the breaches so far have not been in the transmission of the information but of the information when it arrived and was stored at the server site.  https does not solve this problem.
0
 
rmacmichAuthor Commented:
Jhurst -- thanks.  I appreciate your answer and agree with you on both points you made.  :)

Have a good one.

0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now