How can I tell if a web page is secure?

[Manny]

Anytime a web page asks you for sensitive information, you need to be able to identify if the page is secure or not. The ability to recognize a secure web connection is extremely important as online fraud cases have increased substantially from year to year.

What exactly do we mean by "secure"?

Anytime you view a web site information is sent from your computer to the web server and from the web server to your computer. The transmission of this information is normally sent in "plain text", meaning anyone would be able to read it should they see it. Now consider this. Each piece of information transmitted traverses many computers (servers) to reach its destination.

Try it! - Windows Users, to see just how many machines your information traverses, follow these steps:

1) On your computer, click Start, then Run
2) Type "cmd" and click "OK" (or press Enter)
3) Type this in exactly: tracert www.ssl.com
4) Press Enter

Each listing in the window is a different computer/router/switch (a "node" in networking terms). Each "node" represents a point at which any data you send might be recorded! It is not uncommon to see 20-30 listings.

Big deal, right? Consider this the next time you type in a password or your credit card number. Ah! Therein lies the problem. The solution to this problem is to encrypt this data for transmission. Secure Sockets Layer (SSL) was created for this very purpose.

SSL uses a complex system of key exchanges between your browser and the server you are communicating with in order to encrypt the data before transmitting it across the web. A web page with an active SSL session is what we mean when we say a web page is "secure".

ALL WEB PAGES ASKING YOU FOR SENSITIVE INFORMATION SHOULD BE SECURED USING SSL!!!

[Aileen]

That's so informative Manny! In addition, for online shopping, it can be hard to tell if you are on a secure website or not. In most cases, if the web address is written like this "https://" the data is better off than on a website which is "http://" only. Most payment pages are through a secure connection. Just remember before you give out any information such credit card info, make sure that the address has the "https://" in the URL.

[Yourup]

You certainly hit the nail on the head. I've been worried about the security of certain sites lately to the point that I really have to think twice about it before giving them my info. Now I've got some kind of reference. Thanks for the heads up!

By the way, how do we know these pages are SSL'd? Do we just take their word for it?

[Manny]

Originally Posted by Yourup

By the way, how do we know these pages are SSL'd? Do we just take their word for it?

SSL was primarily developed to cater the needs of securing a page.

There is a de facto standard among web browsers to display a "lock" icon somewhere in the window of the browser (NOT in the web page display area!) For example, Microsoft Internet Explorer displays the lock icon in the lower-right of the browser window:



As another example, Mozilla's FireFox Web Browser displays the lock icon in the lower-left corner:



THE LOCK ICON IS NOT JUST A PICTURE! Click (or double-click) on it to see details of the site's security. This is important to know because some fraudulent web sites are built with a bar at the bottom of the web page to imitate the lock icon of your browser! Therefore it is necessary to test the functionality built into this lock icon. Furthermore, it is very important to KNOW YOUR BROWSER! Check your browser's help file or contact the makers of your browser software if you are unsure how to use this functionality.

Try it! - Visit ssl's home page (http://www.ssl.com). Click the link to "Log in" to initiate a secure session. Note the lock icon display in YOUR browser. Click the icon, or double-click (varies by browser), and examine the security information displayed about the web site. If there is no display at the bottom of your browser try clicking "View" in the main menu and make sure "Status Bar" is checked.

[Yourup]

Thanks for your informativeness. I'll have to start doing that when something looks dodgy.