Security and Encryption

When it comes to accepting online payments and other sensitive information over the web, normal HTTP just doesn't cut it. It's an insecure method of communication where everything is sent over the wire in cleartext - it's completely trivial for anyone in a network administrator position at a business or ISP to gain access to the network, and most networks are even vulnerable to 'sniffing' by non-privileged users of the network. Things are bad enough that you really shouldn't even transmit any passwords without taking additional security measures, unless the things the passwords give access to are entirely trivial - put simply, as a webmaster, you need to be worried about encryption and security. But how can you add them to your website? Well, it's not as difficult as you think, because there's a standardised way of doing it: SSL. What is SSL? SSL stands for Secure Sockets Layer. It is a method of using cryptography to make sure that communication between a server and a client is secure: in other words, data sent can't be intercepted or tampered with in any way. SSL works using a variety of encryption methods, but the most important feature is that SSL certificates effectively certify that a site is the real thing, which helps to prevent spoofing. When SSL is combined with HTTP, it becomes HTTPS (Secure HTTP), a powerful way for web browsers and web servers to send sensitive data back and forward securely. If all that was over your head, maybe I should put it to you in the way that your customers will. SSL is what makes their web browser come up with the little padlock symbol that means your website is secure for them to enter sensitive information into. If there's no padlock, they don't want to do business with you. However, you should also be aware of what SSL is not: it isn't a complete security package. If you transmit data over HTTPS and then store it in a database unencrypted when it reaches your server, someone with access to the database will still be able to easily retrieve the data. SSL is not the answer to everything - it's simply a way of avoiding anything happening to the data while it's 'out there', travelling across the Internet. Of course, your customers are unlikely to realise that (they think the padlock works like magic), but you at least should. Levels of Encryption There are three main levels of SSL encryption: 40-bit, 128-bit and 256-bit. It's very important to emphasise at this point that 40-bit SSL is now outdated and deprecated: you would be a fool to use it. The only reason 40-bit encryption was available to begin with was because the US government was initially afraid of exporting cryptographic algorithms that were strong enough to be used against them: 40-bit was strong enough for most web uses, but still weak enough that they could break it by brute force with their powerful computers. The US was persuaded to relax the restrictions when the government realised that they were doing nothing but forcing IT development to other countries, but by then there had been widespread adoption of 40-bit encryption. Now, years later, there's really no reason to be using it. You should go for 128-bit as a minimum, and preferably 256-bit - what you can afford will likely be dictated by the value of the goods you sell. If you think anyone is likely to try to break your encryption, you should get the best you can. How Do I Use SSL? If your web host supports SSL, then it should already be all set up for you (if you host your website yourself, then you might like to take a look at the tutorials at modssl.org to get it installed). However, before you can use SSL, you need to get certified - that is, buy an SSL certificate from one of the trusted certificate authorities. The big three are VeriSign, GeoTrust and Thawte, but they charge relatively high prices. The whole thing works more-or-less the same way as buying a domain name, and, in fact, many domain registrars resell certificates - you can often get a better deal from them than you would from one of the big companies. You can often find perfectly good certificates for as little as $30 per year, if you shop around.