Https

[Zoon]

We have a supplier requesting sensitive information which needs to be filled in on a questionnaire on their website, it includes bank details, full copies of accounts, directors details (names, addresses, personal email, telephone numbers etc).

However the link they have sent is to an http domain, I have pointed out that I am not comfortable with this, but they have stated it is secure (but clearly not).

I asked them why it does not have a security certificate and they have said it doesn't need one as they have had their network pen-tested.

I asked if they would do online banking without encryption and they said no

Does anyone have any advice?

[AndrewEH1]

Find a new supplier?

Why does the supplier need all this information? To prove liquidity?

[Scabutz]

Supplier knows fk all about what they are talking about. Having their network pen test means nothing.

Go elsewhere if you can. fking SSL cert costs a tenner, why wouldn't you have one.

[akirk]

https simply encrypts the conversation between browser and server - it has nothing whatsoever to do with the security of the server / website code.

so if you are on your own network which is secure then you probably have zero issue
if you are on wifi sitting in a Costa coffee shope, then perhaps it will be of more concern...

[NorthDave]

They have zero idea of what they are talking about but at least you can get some comfort in the fact their network might be secure if you give them the information.

The https bit will encrypt your answers until they reach their network. No way would I give them this information over an un-encrypted link.

[Munter]

Zoon said:

We have a supplier requesting sensitive information which needs to be filled in on a questionnaire on their website, it includes bank details, full copies of accounts, directors details (names, addresses, personal email, telephone numbers etc).

However the link they have sent is to an http domain, I have pointed out that I am not comfortable with this, but they have stated it is secure (but clearly not).

I asked them why it does not have a security certificate and they have said it doesn't need one as they have had their network pen-tested.

I asked if they would do online banking without encryption and they said no

Does anyone have any advice?

If they can't get this right, and the culture is to immediately lie and obfuscate. Is their network actually secure? Really? Not sure I'd believe them.

[maffski]

It is irrelevant (although stupid for precisely this reason) whether the page displaying the form is https or not - what matters is where the form is submitted.

Usually if you hover over the submit button the browser will show you the destination, if this is https then you're fine.

As a side note, you can never assume a form is secure unless you have disabled javascript, otherwise the destination of the form could be re-written on the fly.

[Zoon]

akirk said:

https simply encrypts the conversation between browser and server - it has nothing whatsoever to do with the security of the server / website code.

so if you are on your own network which is secure then you probably have zero issue
if you are on wifi sitting in a Costa coffee shope, then perhaps it will be of more concern...

But technically as the information is travelling un-encrypted it could be read by others surely?

[8bit]

maffski said:

It is irrelevant (although stupid for precisely this reason) whether the page displaying the form is https or not - what matters is where the form is submitted.

Usually if you hover over the submit button the browser will show you the destination, if this is https then you're fine.

As a side note, you can never assume a form is secure unless you have disabled javascript, otherwise the destination of the form could be re-written on the fly.

This. OP, are you able to post a link to the page in question? Plenty of folk here should be able to inspect the source quickly and see if the form is posting the data to a secure URL or not.

If not, and you proceeded anyway, then the chances of your data falling into malicious hands are very, very remote - but it's still a very basic precaution to encrypt sensitive data over the internet so I wouldn't do business with such a supplier either.

[Scabutz]

maffski said:

It is irrelevant (although stupid for precisely this reason) whether the page displaying the form is https or not - what matters is where the form is submitted.

Usually if you hover over the submit button the browser will show you the destination, if this is https then you're fine.

As a side note, you can never assume a form is secure unless you have disabled javascript, otherwise the destination of the form could be re-written on the fly.

But also if the form is being submitted to the same domain then they clearly wont have HSTS headers set, otherwise the whole site would be in HTTPS. Which again shows that they don't value security as much as they like to make out.

Part of the point of SSL (beyond encryption) is to provide assurance to the user its secure. The fact that the form where you enter the data isn't , even if the destination is, is still crap design. They have said in the OP that they don't think it needs one.

Never mind the fact that they say their network is secure but is the destination on their network, or on a 3rd party provider?

Sure the chance of it being intercepted is low. But the mitigation is simple and costs knack all.

[akirk]

Zoon said:

akirk said:

https simply encrypts the conversation between browser and server - it has nothing whatsoever to do with the security of the server / website code.

so if you are on your own network which is secure then you probably have zero issue
if you are on wifi sitting in a Costa coffee shope, then perhaps it will be of more concern...

But technically as the information is travelling un-encrypted it could be read by others surely?

only if they have access to the wire on which that data travels - far less common than you would think...
in reality - issues in losing data from an internal network will generally be spyware / key loggers / etc. infecting your machine (in which case http v https is irrelevant) - issues losing it on a wifi network could be someone listening in - (in which case http v https is relevant)

in reality it will probably make zero difference to you, though you are right to raise it...

Scabutz said:

Part of the point of SSL (beyond encryption) is to provide assurance to the user its secure.

it is - though it is a red herring really as SSL does nothing to tell you about the actual security of the website - which could be very poorly written - so you get reassurance which could be totally false - it has also lead to companies 'getting the green padlock' and assuming they need do no more...

so ironically - the company in discussion could be accurate and be more secure - but without the reassurance - however, I would agree that as SSL is at its cheapest free, and even if commercial, no more than a few pounds a month, it does seem silly to not have it...

edited to avoid repercussions offline

Edited by akirk on Wednesday 27th March 16:07

[Munter]

akirk said:

issues losing it on a wife network could be someone listening in - (in which case http v https is relevant)

Well now that is true. Once information is intercepted by Wife network it spreads like wildfire and https will have no effect on slowing that down.

[bitchstewie]

It's free so there's no reason not to do it.

They're basically making excuses for doing daft st.

[akirk]

Munter said:

akirk said:

issues losing it on a wife network could be someone listening in - (in which case http v https is relevant)

Well now that is true. Once information is intercepted by Wife network it spreads like wildfire and https will have no effect on slowing that down.

and you try encrypting it!!!!

[captain_cynic]

akirk said:

https simply encrypts the conversation between browser and server - it has nothing whatsoever to do with the security of the server / website code.

so if you are on your own network which is secure then you probably have zero issue
if you are on wifi sitting in a Costa coffee shope, then perhaps it will be of more concern...

Not really, an MITM (Man In The Middle) attack can happen at any point between the browser and the receiving server, not just the local networks at either end. Can you guarantee that every single router you could possibly be sent through can be free of malefactors? I won't, ISP's do get their routers hacked, if they're lucky the person hacking it does something malicious instead of just sticking a packet sniffer on there (many routers have the capability to do packet inspection these days, for the most part it's a feature used to find network problems but can be used to for less legitimate means).

HTTPS encryption effectively stops any MITM attack.

OP, the best solution is to find a new supplier... or at least start doing thing by paper, as convoluted and annoyingly as possibly until they get the hint. Certificates are one of the banes of my existence, but a completely necessary one.

[akirk]

captain_cynic said:

akirk said:

https simply encrypts the conversation between browser and server - it has nothing whatsoever to do with the security of the server / website code.

so if you are on your own network which is secure then you probably have zero issue
if you are on wifi sitting in a Costa coffee shope, then perhaps it will be of more concern...

Not really, an MITM (Man In The Middle) attack can happen at any point between the browser and the receiving server, not just the local networks at either end. Can you guarantee that every single router you could possibly be sent through can be free of malefactors? I won't, ISP's do get their routers hacked, if they're lucky the person hacking it does something malicious instead of just sticking a packet sniffer on there (many routers have the capability to do packet inspection these days, for the most part it's a feature used to find network problems but can be used to for less legitimate means).

HTTPS encryption effectively stops any MITM attack.

True - but I am simplifying - the reality is that it is rare for that to be an issue:
- attacks at the local end (e.g. malware)
- attacks directly onto the server
are the two biggest risks

those making the attacks go for the areas which statistically tend to be more vulnerable - and the website / the end user tends to be less professionally set up - where as most ISP routers etc. are generally set up quite well...

the reality is that the major vulnerabilities are not addressed by https - so it is a bit of a fake as it implies that everything is fine whereas you could have serious issues and still with an https certificate have a nice little green padlock meaning nothing... as your computer is compromised and the end server is vulnerable to SQL injection (etc.)

[jonamv8]

LOL that's bad. not difficult to go https these days is it

[JaredVannett]

Scabutz said:

Supplier knows fk all about what they are talking about. Having their network pen test means nothing.

Go elsewhere if you can. fking SSL cert costs a tenner, why wouldn't you have one.

This.

[PurpleTurtle]

Interesting reading.

I’m getting involved in more and more of these kind of discussions in my work (mainframe applications, being integrated with the web increasingly)

Is there a website or YouTube link that anyone could recommend that explains the basics of internet security to non-web developers?

Thanks

[eltawater]

PurpleTurtle said:

Interesting reading.

I’m getting involved in more and more of these kind of discussions in my work (mainframe applications, being integrated with the web increasingly)

Is there a website or YouTube link that anyone could recommend that explains the basics of internet security to non-web developers?

Thanks

Start at the OWASP top ten:

https://www.owasp.org/images/7/72/OWASP_Top_10-201...

https://www.owasp.org/index.php/Main_Page