Why is your server not secure? Issue

0
I was going to buy your products, but I am not prepared to put my CC details through an unsecure connection.
How did you manage to set up a payment system without an SSL cerificate?
What is your merchant gateway provider's opinion about your compliance?

Accepted Answer

Monday, November 07 2016, 11:25 PM - #Permalink
0
Hello

Ok, I understand

Btw, if you checkout using a mobile device, the stripe payment widget will actually take you to the Stripe website to enter the CC details, so its all handled in stripes secure website directly (instead of presenting you with the little modal box in our website). No sensitive data touches our server whatsoever (only stripe's notification on succesful payment)

Other than that, I can't help you further at the moment
The reply is currently minimized Show
Responses (4)
  • Accepted Answer

    Monday, November 07 2016, 10:48 PM - #Permalink
    0
    Hello,

    our CC provider is Stripe (www.stripe.com). The advantage of Stripe is that it does not require a SSL certificate because the connection is not made from the website to their server, but actually from OUR server to theirs, using a connection over TLS 1.2 (please don't hesitate to check their website and how Stripe payment works)

    Please if you don't feel confortable using Stripe, be aware that we also have PayPal available as a payment gateway (the payment is made entirely on PayPal's website)

    Many thanks for your concerns.
    The reply is currently minimized Show
  • Accepted Answer

    Monday, November 07 2016, 11:05 PM - #Permalink
    0
    And you seriously mean what you wrote?
    If I send my CC details through an unsecured link then anyone between my computer and your server can intercept and harvest the info. Having a secure link between your server and your gateway makes no difference if my data is compromised before it gets there.
    My gateway provider would terminate my account in an instance if I breached protocol like that.

    You either have to let Stripe provide the payment page, or you have to install an SSL certificate on the web site.

    BTW I refuse to do business with PayPal, and I am not the only one.
    The reply is currently minimized Show
  • Accepted Answer

    Tuesday, November 08 2016, 12:08 AM - #Permalink
    0
    That should work. :-)
    Much appreciated!
    The reply is currently minimized Show
  • Accepted Answer

    Thursday, November 10 2016, 05:34 PM - #Permalink
    0
    Hello

    Just for your information, we are serving our store and payment pages through verified SSL (TLS 1.2) for our users security.

    The payment was already being secured (because it was not sent to our server, but to Stripe's servers directly without even touching our server).

    But anyway, for your piece of mind, the store page is now also served through HTTPS.

    Thanks!
    The reply is currently minimized Show
Your Reply