http vs https

[Don]

Article explains the difference between http and https protocols:

Anyone with the technical expertise desire to comment ?

http://www.snopes.com/computer/internet/https.asp

[Ron61]

Don,

HTTP:// Vrs HTTPS://

Ron

[onefastmustang]

Originally Posted by Don

Article explains the difference between http and https protocols:

Anyone with the technical expertise desire to comment ?

http://www.snopes.com/computer/internet/https.asp

The article doesn't however take into account that once that data passes through the SSL portion of the communication it can be converted back into non-ssl traffic. A company that i had dealings with once did this. They transferred the clients data into their private network via SSL (HTTPS) but once it passed into there it was transmitted in open format the rest of the way around their private network from server to server. Bear in mind that their network had multiple layers of firewalls but if they had gotten hacked or had an employee that started to become a problem lots of data could be collected. My philosophy since I design secure networks for ecommerce and privacy is that if it goes over the wire, encrypt it, period.

[Don]

onefastmustang:

My local community bank for real time transactions as well as web sites with on-line purchasing, display a symbol/logo and words " VeriSign Secured " does this imply a higher degree of security ?

For the Bank, do not know if they have their own network or use a service bureau. However, they do have the https

......thanks

Don

[onefastmustang]

If you are a purchaser of an SSL certificate from them you have the right to display that logo on your site. However it does not require any kind of audit for compliance of any level of security. I would assume that since it is a bank they have a their own policies and procedures to maintain security and their own private networks. I have seen some credit unions that have cut cost by using less than top quality software and equipment though.

HTTPS works great up to the front door but once inside how they deal with the data is what can really count.

[Don]

onefastmustang

Would " CyberTrust Certified Enterprise " be the same approach as " VeriSign Secured " ?

..........thanks

Don

[onefastmustang]

Pretty much yes. the only logo I see on some sites that actually means anything are ones like the HackerSafe logo. That company actually does an exterrnal audit of a site using Nessus plugins. If your site passes the tests for the current level that makes you hacker proof then you can use the logo. They also do PCI compliance auditing on the externally facing services of a company. However the front door is where they stop. A good reputable company would hire a PCI auditor to come in and do the rest. Of course knowing what's wrong and actually fixing it are two different things. In these economic times I wouldn't be surprised to see more credit card theft incidents as companies cut their budgets and don't do the right thing.

[Don]

onefastmustang:

Any thoughts on these real time back-up services ?

.....thanks


http://www.syncplicity.com/

https://www.getdropbox.com/

[onefastmustang]

Originally Posted by Don

onefastmustang:

Any thoughts on these real time back-up services ?

.....thanks


http://www.syncplicity.com/

https://www.getdropbox.com/

I have never used either of those. I have used Mozy though and it is owned by a reputable company so I have some faith in it. Home users can backup up to 2GB for free. In this day and age thats not much storage especially if your PC has 3 Terabytes like mine. But for the important stuff it works well. And I think for 5.00 you can go unlimited on storage.