woiuld you say this is 100% correct now and in the future?

[devonwoody]

I would not enter my credit card security number on a secure web page to make a payment.
And got this reply when questioned by the supplier for my refusal to do so.

I totally understand your concern, however just to help ease any worries you may have about entering personal information in the future, I’d like to tell you the following.

Any personal information you supply on our website (and any other reputable website) is not stored anywhere on your computer. The web pages you enter the information on are secure (you should see a padlock on your browser) and when the information is sent, it is encrypted and can’t be unencrypted until it gets to our secure server. Therefore your PC repairer will not see any of this information on your computer because it is not there.

With regards to the last 3 security digits, we obviously require them to take the payment for the order and the reason for them is that they are another check to help show that the card is actually yours.

I telephoned the security number they needed and order then went through.

 

[TonyW]

DW, Interesting comment and I can understand your concern.

The secure aspects mentioned in the reply should suggest all ok (at least I hope so!!) I have done many credit card transactions over the net and found them all to be ok.

The last 3 security digits are interesting - when you pay by credit card in a shop I don't think that they are looked at but are requested by most web sites. While I can understand that they do show you have the card in front of you how can it prove that the card is yours - you could be a villan

I always used to be concerned about the old method where a card was swiped through a machine which produced a couple of copies and a carbon. You left with your own receipt which left the shop assistant with a duplicate and a carbon from which all your details including signature could be seen. What if someone with criminal tendencies got hold of this.

Hopefully there should be a degree of protection from the credit card company as well relating to any "dodgy" transactions.

Cheers
Tony

 

[JackL]

It's always a worry to me handing over my credit card details. Having been brought up in the age of cash and postal orders I have a deep mistrust of anyone who tells me that their web site is absolutely secure.
Having said that, I believe (though I'll stand corrected) that the biggest risk of card cloning comes from petrol stations and restraunts, especially if you hand your card to the waiter who then trots off to some back room to get the payment.
I guess it's just the age we live in. But that said, like Tony, after hundreds of transactions on the internet, I've so far avoided any problems. :?

 

[tim]

Bear in mind that if you use a credit card, the supplier and the CC company are jointly and severally liable. This means that if someone acts fraudulently the either or both parties is responsible in settling the debt.

Frankly I worry more about phoning stuff through having watched people write down details on a scrap of paper by the till counter or worse still repeating all your details out loud in a call center where anyone could write all the info down or record it especially if they end up spelling out you surname. I am still unsure what the security number is for since everyone asks for it.

Cheers

Tim

 

[Bodrighy]

Entering the security number only proves that you have the card in front of you. This would prevent anyone who has seen your number from simply ordering over the net.

The encryption is not foolproof but is enough to stop most people. Those who can crack it are likely to be after bigger fish than you or me. Personally I don't own a credit card and have a bank account with enough in it to back any transactions that I do over the net. As someone who teaches IT I have little faith in any 'security' as I have seen young teenagers crack into so called secure systems too often.

Pete

 

[dirtydeeds]

the 16 bit encryption system is lauded as the most secure, its one the international banks use

aparantly it can be broken


so............................ as for secure???????????


secure my......................... ass,

govenments use far greater encryption

 

[TonyW]

the 16 bit encryption system is lauded as the most secure, its one the international banks use

aparantly it can be broken


so............................ as for secure???????????


secure my......................... ass,

govenments use far greater encryption

I think that you should find that most modern web browsers use SSL protocol for secure transactions such as ecommerce purchasing and banking I believe the early implementations of SSL were 40bit which were said to be easy to decipher. Currently I think all browsers should be 128 bit encryption which offer much higher levels of protection (seems that brute force methods are needed to crack it).
According to some computer guru's 128 bit encryption should be good enough for the next 10 years :shock: Not sure how they work that out or what year they started counting
You can confirm what level encryption by looking at Help menu / About IE etc.

I do believe that all encryption can be broken (eventually) by those with the knowledge time and perseverance. The best we can hope for is that it is just not worth the time and trouble for those with criminal intent.

I also believe that you are probably more at risk from inadvertently downloading a keylogger which sits quietly unseen in the background recording all keystrokes or some other Trojan or Worm. Then of course there is always the chance that there is a van parked somewhere near you recording your monitor screen activity. :shock:

So as dirtydeeds says "secure my......................... ass"

Cheers
Tony

 

[Shultzy]

DevonWoody, if you are worried about revealing your details over the web, check out this demo of Cahoots virtual webcard.

http://www.cahoot.com/cahoot_products/o ... bcard.html

I have one and it works ok for all purchases.

 

[devonwoody]

The replies provided above are also my thoughts on the subject also.
Secure my ............?
One minute banks and others are telling us everything is secure and I suppose thats because they want us to use the system. But these days they then find a reason to appoint blame to the consumer for not being vigilant enough when it suits them.

 

[Anonymous]

DW

The sites wiht the padlock use secure sockets layer (SSL) usually and I have programed this for a company the past. There is no way anyone can intercept and decode your credit card details when being sent over to the supplier, however, they can prevent the communication arrivng. This will be evident when the supplier raises an error of some sort (please re-enter details etc.). Note tha interrupting the transmission still does not allow them to decode your rdetials - they cannot without other information that canot possibly have

So, transmission is secure.

Information stored on the suppliers system is something else and I do not use any supplier who asks me to "create an account for my convenience" as they will store all your card details on their computer which may not be secure. Amazon store the card details but allow you to delete them after each transaction - which I do.

NEVER email your details to anyone

 

[devonwoody]

Thanks Tony.

But what about keyloggers (worms & trojans) oddly enough received Bullguard security virus update on this practice this morning in my mail.

 

[tnimble]

About the encription and SSL.

SSL only describes the way data is exchanged not the encryption method in use. Both the browser and the web server have a set of encryption methods. The best supported method is selected during the inital handshake. Along with passing an authentication key for the web server.

The number of bits listed in the Help About screen is not the number of bits used but the limit of maximum bits that can be supported. Countries like the USA forbid any high encrupted communication by law. This number ion that particular screen only shows if that browser may be used in the USA. An webserver that is located in the USA has the same restriction. This mean that wven while the screen sais 128 bit when communication with the state a LOWER encruption IS USED.

The closed padlock only indicates the authenticity of the URL visited is correct. It does NOT indicate that the URL you are visiting does belong to the person or company you think your are. I can offer you with a website looking like for instance Amazon and take your details. The padlock is closed since I am indeed http://www.amazom.com/ or maybe something like http://amazon.surepurch.com/

But even when the URL is correct and the padlock is closed I can easily intercept the data. This is called a man in the middle attack. All data you sent goes to me and I sent it to the real web server. I again receive the response which in turn I sent that back to you.

However due to the encyption I can not read the data since it is encrypted, nor can I modify the data. However I can break the secure communication with you and start communicating unencrypted with you. Now I can read and, store and manipulate your data. I also setup an encrupted connection myself with the real webserver, encrypt your data, unencrypt the response, back manupulate the response and sent that to your using my unencrypted connection I have with you back to you.

Since the connection between you and me is now not encrypted any more the closed padlock vanishes somewhere throughout your visit. But you did not notice this because at first the closed padlock was present.

So besides checking the padlock it is vital to check if the padlock is closed just prior to pressing the submit button.

But even better for me browsers contain bugs. In particular if you would be using Microsoft Internet Explorere the padlock remains closed until you visit another web site. You have no means at all to check is the connection is still encrypted when sending your vital payment information.

How plausible is that youre trapped into this attack aka how easy is this setup? Very easy if you buy something online at work. The internal company network is commonly not well secured and it is easy to just plug in an extra computer. Public places are even more dangerous, since you have no relation with them and have no info if for instance an internet cafe is run by untrustworty people. The sole pupose of the place couldbe a scam.

However when you buy online from home the person taking your money has to work for either your ISP or the store you're buying at. Or has to be very advanced. He/she also has to do many more actions like tapping into an ISP network, spoof name server etc. That one goes through all that trouble at all and also succeeds in every step is very unlikely. Its a million times easier, safer and profitable to sent phishing emails to fool you into giving your details voluntarily.

 

[TonyW]

Tony,
Your points about transmission being secure with SSL is very encouraging. The fact that you have had real programming experience and obviously in depth knowledge of the subject gives even more confidence in the system. Although still think a healthy degree of paranoia in order

I must say that your comment on information stored on suppliers system was a bit of a wake up call to me. Strangely enough I had not considered this as being too much of a risk Think I need to check out those suppliers that have my details stored :shock:

DW
As you know I believe that keyloggers in particular are the greater risk. Even with SSL 128 bit encryption your original keystrokes can be recorded and saved to a hidden file on your disk ready for transmission to some villainous individual with evil intent
What is not clear is the level of risk.

Cheers
Tony

 

[Russell]

For your information the last 3 digits your post card and house number of the billing address are all required for mail order transactions. The numbers verify the billing address of the credit card. If a retailer does not enter this information for a mail order transaction then they are not covered if the transaction is fraudulent. The credit card companies then confirm to the retailer whether the information matches what is on record. If the information does not match the retailer then has the option to decline the transaction. The whole process is to help against credit card theft. How ever if you keep address information in your wallet then you give the thieves all the information they need and will depend on you realising the cards have been stolen and stopping them.

 

[Taffy Turner]

Personally I don't own a credit card and have a bank account with enough in it to back any transactions that I do over the net.
Pete

Pete,

I used to do the same as you, until it was pointed out to me that Credit Cards have better levels of protection if a fraudulent transaction does occur than Debit Cards. (I believe it is something to with CCs being covered by the Consumer Credit Act, whereas DCs are not)

It was for this reason that I applied for a credit card, and now use that for all my purchases, and then pay off the bill in full each month, so I don't pay any interest. I applied for a Morgan Stanley cash-back card, and my cash-back total is now approaching £200!!! 8) (Sadly this card isn't available to new applicants any more!!!).

If a crook gets hold of your debit card details, they could potentially empty your account, whereas if they get hold of you credit card details, they can only go up to your credit limit, and it isn't your money that they have stolen.

Regards

Gary

 

[Anonymous]

I must say that your comment on information stored on suppliers system was a bit of a wake up call to me. Strangely enough I had not considered this as being too much of a risk Think I need to check out those suppliers that have my details stored :shock:

Tony

Hi Tony

Yeah, a few companies have been hacked and thousands of people's details stolen in the past. Not common, but wouldn't like to trust my details to some IT geek's skills (or not) somewhere :lol:


I have actually emailed companies and refused to buy from them unless they allow me to delete my details or they are not stored in the first place

SSL is pretty much as safe as it gets (128 bit encryption is perfectly adequate) but tnimble's post suggests one can be duped (nothing to do with a failing of SSL though). Need to keep an eye on that padlock.

 

[Dibs-h]

I hear what you are saying but to be honest - with SSL, most of the certificates supplied are 128 bit and you can verify the site - any reputable site will have the shop at the root, i.e. the main site will be,

http://www.sometoolshop.com

and the moment you start "shopping" it will be

https://www.sometoolshop.com

the certificate does authenticate the site. Spoofing does exist, but if you take rudimentary steps, your are far less likely to get taken for a ride.

Steps such as,

- do they have a real address and real phone nbr (not some 0870) and does the certificate details match it. Almost all certificate authorities allow you to confirm the cert and who it's issued to, online.
- do you know others who use them
- are they advertisers in sites such as this or in the various mags,

If you are want to be super safe - keyloggers etc - I would suggest you download and install Microsoft's Virtual PC. I believe they offer pre-built ones. It's like a PC in a PC and starts up like a real PC, but as an app. You use that for surfing and then when you shut it down, you choose not to save any changes. That way any parasites you may have acquired get wiped.

Even the security gurus I know surf this way and off all the ways to surf, it is currently the most secure - short of not surfing.

With respect to the vendor storing your CC details - it is against the terms and conditions of their Merchant account and Visa wouldn't take it to kindly. They would only store it the same way it is shown on your receipt when you physically use it, i.e *************** 1234.

When you type it in to their site (over SSL) their secure server opens a secure session to the acquirers server and passing the details, AVS, etc. They either get a pass or fail - assuming they are not doing a pre-auth.

They not not record the details - it's not allowed.

I don't have money to burn - but I don't loose sleep over it, assuming I've done my checks beforehand, and my Virtual PC is squeaky clean.

I've worked for some of the largest acquiring\issuing banks\Visa in the last 10 years and their own networks are extremely secure.

As for higher levels of encryption being forbidden - sorry I have to disagree. There are export restrictions to certain countries, but not to Europe. Some of the Microsoft systems we use are currently at 256bit encryption.

Visa's own internal network uses hardware level encryption which is far superior - I've been involved in the commisioning of some of their systems. Try to even unplug their hardware without the appropriate sets of keys and personel and it physically burns out the entire device in under 20s.

 

[devonwoody]

Thanks for the responses above and time freely given by all to my thread.

 

[tnimble]

I hear what you are saying but to be honest - with SSL, most of the certificates supplied are 128 bit...

This is the strength of the key used to generate the certificate date used to verify the URL of a site and prove some textual information about the isuer and owner and a copy of the certificate of the certificate authority.

After the URL has been verified to be the same as the site you are visisting (no matter if ths URL is either www.amazon.com www.amazom.com as long as it matches) an encryption standard is negotiated an a new random encryption key is generated of any arbitrary number of bits. Which can be as weak as 48 bit or as stong as 768 and higher.

and you can verify the site - any reputable site will have the shop at the root, i.e. the main site will be,

http://www.sometoolshop.com

and the moment you start "shopping" it will be

https://www.sometoolshop.com

the certificate does authenticate the site. Spoofing does exist, but if you take rudimentary steps, your are far less likely to get taken for a ride.

Steps such as,

- do they have a real address and real phone nbr (not some 0870) and does the certificate details match it. Almost all certificate authorities allow you to confirm the cert and who it's issued to, online.
- do you know others who use them
- are they advertisers in sites such as this or in the various mags,

When using the man in the middle scenario I state above:
- you are visiting the real shop through me
- you are dealing with a respectable real shop (or with your own real bank in case of online banking)
- all contact information checks out
- you can sent them emails and get a response from them
- the URL in the address bar is correct:
* while visiting (ie http://www.amazon.com/)
* while shopping (ie https://www.amazon.com/)
* while checking out (ie. https://www.amazon.com/)
- All the information in the dialog that popsup when you double click the padlock is correct.
- The order will proceed as you would expect
- you get all normal confirmation emails from the real shop

Depending on the browser used also
- The padlock remains closed when confirming your payment to me instead of the rela shop
- The URL in the address bar remains correct
- The information in the dialog behind padlock still states your communicating with the real shop instead of me.

If you are want to be super safe - keyloggers etc - I would suggest you download and install Microsoft's Virtual PC. I believe they offer pre-built ones. It's like a PC in a PC and starts up like a real PC, but as an app.

Indeed a very effective method to prevent keylogger etc. About any virtual machine software program can be used for that. Along with having a good and up to date virus scanner and firewall installed and activated.

You use that for surfing and then when you shut it down, you choose not to save any changes. That way any parasites you may have acquired get wiped.

Even the security gurus I know surf this way and off all the ways to surf, it is currently the most secure - short of not surfing.

With the addition that you should not do all your surfing. Start the virtual machine, start the browser and go directly to the shop, order your stuff and shtdown the virtual machine without saving.

Also
- alway use the last version of the browser
- apply all avaialbe update for your operating system and applications
- preferable don't use internet explorer and ootlook
- check the URL, padlock and the information behind the padlock.
- recheck this information when making the payment
- never shop from a public place or a strangers computer
- be aware and cautious of shopping from work esp medium large companies

I've worked for some of the largest acquiring\issuing banks\Visa in the last 10 years and their own networks are extremely secure.

I fully agree to that 100%

As for higher levels of encryption being forbidden - sorry I have to disagree. There are export restrictions to certain countries, but not to Europe. Some of the Microsoft systems we use are currently at 256bit encryption.

It not depended on the location you're at. The ristrictions applied by the software (both at your and the shops end) are dependend on the version and age of the used software and libraries. If you use an older version of browser for instance which was intended to be for used in the US or some other regeons a restriction of either 48 of 64 bit can apply. No matter if you would be physically located in the UK, Sweden or on the moon.

Visa's own internal network uses hardware level encryption which is far superior - I've been involved in the commisioning of some of their systems. Try to even unplug their hardware without the appropriate sets of keys and personel and it physically burns out the entire device in under 20s.

This applies to about all networks of any bank or institute that handle, process or store electronic money transfers. Also plugging in any hardware causes the are of network to shutdown and security to be alerted of the event including the exact location within the building.

This prevent about any possibility of foul play by any employee or visitor of the institute / company. But is does not prevent any event happening between your screen and keyboard and their internet connection.

 

[White House Workshop]

Just a comment on 0870 numbers...

There's a website called SAYNOTO0870.COM where you can type in the 0870 number and it'll give you a 'real' number. Useful if the company is local, or if you call them from a mobile and don't want to be double-charged for the call.