从非 SSL“发布”到 SSL 的信息安全吗？
我正在研究 Authorize.net 的新“直接邮寄方法”来处理信用卡交易。此前，我的公司一直使用 Auth.net 的 AIM 来处理信用卡，而无需离开我们的网站。此方法要求我们有 SSL。
然而，Auth.net 的新 DPM 表示，客户仍然在我们的网站上付款，但我们不需要 SSL 来保证安全。这对我来说似乎有点奇怪，但这就是 Auth.net 所说的。您可以在此处查看图表：http://developer.authorize.net/api/compare/。
所以，我的问题是这样的；如果我有一个没有 ssl (http://etc...) 托管的页面，该页面发布到 SSL (https:///etc...) 发布的信息安全吗？
感谢您的任何帮助。
I am looking into Authorize.net's new "Direct Post Method" for handling credit card transactions. Previously, my company has been using Auth.net's AIM to process credit cards without leaving our website. This method requires that we have an SSL.
However, this new DPM that Auth.net has says that the client still pays on our website but we don't need an SSL for security. This seems a bit odd to me but that's what Auth.net says. You can see the charts here: http://developer.authorize.net/api/compare/.
So, my question is this; if I have a page hosted without an ssl (http://etc...) that posts to an SSL (https:///etc...) is the POSTed information secure?
Thanks for any help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
从技术上讲，信息在传输过程中可能是安全的（点击提交按钮后）。但填写表格的人不可能知道它是安全的（那么他们为什么要信任您的网站呢？）。毕竟，如果 URL 栏没有表明它是 HTTPS 页面，他们怎么知道它将 POST 到 HTTPS 站点呢？
我之前写过关于这个问题。尽管我被指责过于偏执，但我仍然坚持认为，如果我提交的页面（当然，以及提交的页面）都是 SSL，那么我不会信任拥有我的信用卡详细信息的网站。
看：SSL 的全部目的是防止中间人攻击（这就是它的全部作用）。如果您的表单不受保护，则攻击者可以修改表单以提交到他们想要的任何位置。
中间人攻击允许攻击者修改或监控通过互联网传输的信息。随着不安全无线网络、BGP 中毒、DNS 攻击以及每天发现的新漏洞的普遍存在，执行中间人攻击也变得越来越容易。
Technically, the information may be secure in transit (after hitting the submit button). But the person filling out the form can't possibly know that it will be secure (so why should they trust your site?). After all, if the URL bar doesn't indicate that it is an HTTPS page, how are they supposed to know that it will POST to an HTTPS site?
I wrote about this once before. Although I was accused of being overly paranoid, I still maintain that I wouldn't trust a site with my credit card details if the page that I'm submitting from (and to, of course) are both SSL.
Look: The whole point of SSL is to prevent man-in-the-middle attacks (that's all it does). If your form isn't protected, then an attacker could modify the form to submit to wherever they want.
Man-in-the-middle attacks allow an attacker to modify or monitor information while in transit across the internet. With the prevalence of insecure wireless networks, BGP poisoning, attacks on DNS and new vulnerabilities being discovered every day, it's also becoming increasingly easy to perform a man-in-the-middle attack.