redrat Posted August 1, 2009 Share Posted August 1, 2009 Well, I am building a site using Joomla 1.5.14 (Shape5 New Architect theme) with WHMCS 4.0.2 (Customised Portal template) already integrated. Most images are already set to https:// whereas others, including some in both Joomla and WHMCS, will not even appear if https is used to call them. And this is the most confusing part for me. I am also using one of Sparky's mods, Client Area Home which cannot be seen unless logged in. I'll PM you my URL. 0 Quote Link to comment Share on other sites More sharing options...
nerbonne Posted August 1, 2009 Share Posted August 1, 2009 (edited) I agree, the threat of a stolen database is the REAL threat. You get a trojan on your server that allows them to download your database, you're done. The SSL cert doesn't do anything except make ignorant people think that they are safe. It's like hiring an armored car to transport your gold bars from the airport to your house, but once at the house, you lock the front door with only the door knob, which anyone knows provides very little security. Adding to another point made by brianoz, we used to run our company site on a shared server running in Apache mode vice CGI. Eventually we switched to CGI mode and moved all the client sites off of the server, but years later I just now found trojans buried in our site that were years old. SSL means nothing. Insecure servers will destroy you, and an SSL certificate will do nothing to help. Believe what you will, as like brianoz pointed out, until it happens to you, you won't listen. Paypal uses SSL, but is that going to save them if someone manages to get a trojan onto their server? Edited August 1, 2009 by nerbonne Added more rant... 0 Quote Link to comment Share on other sites More sharing options...
DedicatedPros Posted August 1, 2009 Share Posted August 1, 2009 (edited) I agree, the threat of a stolen database is the REAL threat. You get a trojan on your server that allows them to download your database, you're done. The SSL cert doesn't do anything except make ignorant people think that they are safe. It's like hiring an armored car to transport your gold bars from the airport to your house, but once at the house, you lock the front door with only the door knob, which anyone knows provides very little security. Adding to another point made by brianoz, we used to run our company site on a shared server running in Apache mode vice CGI. Eventually we switched to CGI mode and moved all the client sites off of the server, but years later I just now found trojans buried in our site that were years old. SSL means nothing. Insecure servers will destroy you, and an SSL certificate will do nothing to help. Believe what you will, as like brianoz pointed out, until it happens to you, you won't listen. Paypal uses SSL, but is that going to save them if someone manages to get a trojan onto their server? You're talking about security here and you're saying that you only need to secure the server, and nothing else? I mean read your posts, even the scenario you proposed, and tell me that the route of the sensitive data does not need to be secured... If you want the gold bricks secure you will need an armored car (your SSL certificate) but you'll also need a fort surrounded by soldiers (data encrypted on you server using encryption such as MD5 with random salts). If you're going to let someone get that trojan horse on the server than yea, obviously the certificate can't do you any good but you're talking about apples and bombs here, one has nothing to do with the other as an SSL certificate is not a <<snipped>> anti-virus program. Edited August 2, 2009 by bear language 0 Quote Link to comment Share on other sites More sharing options...
Dominic Posted August 3, 2009 Share Posted August 3, 2009 Really the only way to intercept the data path is to hack into a switch and activate the monitoring port (which in many cases these days is forced to be a physical port, so is really hard as someone has to change a physical wire in the data centre), or to hack into a router. Not impossible, but very, very hard and getting even harder. Come back when you've done a security course. Probably one of the first things my university taught in networking class.... And apart from that, have you heard of wifi sniffing - very popular these days. There's /no/ excuse or reason not to use SSL. Obviously it isn't all there is to security (we can dream!). 0 Quote Link to comment Share on other sites More sharing options...
meechp123 Posted August 6, 2009 Share Posted August 6, 2009 What about Shared SSL? 0 Quote Link to comment Share on other sites More sharing options...
WHMCS Support Manager WHMCS John Posted August 6, 2009 WHMCS Support Manager Share Posted August 6, 2009 No, won't work. 0 Quote Link to comment Share on other sites More sharing options...
meechp123 Posted August 6, 2009 Share Posted August 6, 2009 Is the SSL issue such a big deal because WHMCS isn't encrypted during the check out process? 0 Quote Link to comment Share on other sites More sharing options...
scurrell Posted August 6, 2009 Share Posted August 6, 2009 Is the SSL issue such a big deal because WHMCS isn't encrypted during the check out process? Depends whether you want potential customers to go elsewhere or not. 0 Quote Link to comment Share on other sites More sharing options...
meechp123 Posted August 6, 2009 Share Posted August 6, 2009 Depends whether you want potential customers to go elsewhere or not. So, if they stay on WHMCS during the checkout process, I dont have to worry about SSL? I see on your site (https://www.fast2host.com/client/cart.php?gid=7), the order form stays on your website and you're using SSL ; are you pointing to WHMCS or is it installed on your server? Sorry, I'm just trying to wrap my head around the process. I would prefer to set my site up like yours (SSL and WHMCS is integrated into my website). 0 Quote Link to comment Share on other sites More sharing options...
merlinpa1969 Posted August 6, 2009 Share Posted August 6, 2009 well since YOUR THE HOST it would be your server cert that would be the shared ssl cert you still need to buy one 0 Quote Link to comment Share on other sites More sharing options...
scurrell Posted August 6, 2009 Share Posted August 6, 2009 I see on your site (https://www.fast2host.com/client/cart.php?gid=7), the order form stays on your website and you're using SSL ; are you pointing to WHMCS or is it installed on your server? We've integrated WHMCS into our site. 0 Quote Link to comment Share on other sites More sharing options...
Exoware Posted August 6, 2009 Share Posted August 6, 2009 I'd like to point out that although there is little chance of data being intercepted during transit generally over the Internet, there is a significantly higher chance of it being intercepted over a shared (public) network where a lot of standard sub-par networks are susceptable to ARP poisoning which can redirect all network traffic through a network device pretending to be the network gateway. Whilst SSL is seriously overhyped, you are tempting fate if you don't use one for transactional purposes. 0 Quote Link to comment Share on other sites More sharing options...
meechp123 Posted August 7, 2009 Share Posted August 7, 2009 We've integrated WHMCS into our site. Thanks Scurrell. Do you have an owned license or a monthly lease? I'm asking because I'm not sure if in order to integrate WHMCS into your site, if the Owned License is necessary. 0 Quote Link to comment Share on other sites More sharing options...
rslyon Posted August 7, 2009 Share Posted August 7, 2009 Either WHMCS license will allow you to integrate. But we have the monthly lease license. 0 Quote Link to comment Share on other sites More sharing options...
meechp123 Posted August 7, 2009 Share Posted August 7, 2009 Awesome! Thanks for much for the info! 0 Quote Link to comment Share on other sites More sharing options...
freedombi Posted August 7, 2009 Share Posted August 7, 2009 I'm surprised no one here has mentioned wireless, which is like being on a hub, only more open. It's trivial to watch someone else's traffic if there's no encryption at the access point, and still fairly easy if it's weak encryption. And wireless is rather common. 0 Quote Link to comment Share on other sites More sharing options...
DedicatedPros Posted August 7, 2009 Share Posted August 7, 2009 Well if you have an unsecured AP than shouldn't use the interwebz 0 Quote Link to comment Share on other sites More sharing options...
meechp123 Posted August 7, 2009 Share Posted August 7, 2009 Well if you have an unsecured AP than shouldn't use the interwebz ...and add to the fact that this thread is about SSL...not Network Security. 0 Quote Link to comment Share on other sites More sharing options...
DedicatedPros Posted August 7, 2009 Share Posted August 7, 2009 ...and add to the fact that this thread is about SSL...not Network Security. Heh, its technically about SSL, which for all I care, could mean encryption your porn stash using SSL 0 Quote Link to comment Share on other sites More sharing options...
brianoz Posted August 30, 2009 Share Posted August 30, 2009 I'm surprised no one here has mentioned wireless, which is like being on a hub, only more open. It's trivial to watch someone else's traffic if there's no encryption at the access point, and still fairly easy if it's weak encryption. And wireless is rather common. ... yes, a great point I was about to make - public WiFi - or even nominally provate WiFi with no/WEP encryption - is a compelling reason for SSL ... 0 Quote Link to comment Share on other sites More sharing options...
meechp123 Posted August 30, 2009 Share Posted August 30, 2009 I sent you a link to a good site with the cert you need Could I have that link as well? 0 Quote Link to comment Share on other sites More sharing options...
DedicatedPros Posted August 30, 2009 Share Posted August 30, 2009 http://www.enom.com/secure/ssl-certificates-purchase.aspx?sslcert=geotrust&CertID=23 0 Quote Link to comment Share on other sites More sharing options...
Derek Posted August 30, 2009 Share Posted August 30, 2009 Well if you have an unsecured AP than shouldn't use the interwebz You don't even have SSL yourself LoL. 0 Quote Link to comment Share on other sites More sharing options...
DedicatedPros Posted August 30, 2009 Share Posted August 30, 2009 You don't even have SSL yourself LoL. I know it expired and I was getting bad support from the reseller I've sent in documentation to Thawte and I'm waiting for my cert to be issued 0 Quote Link to comment Share on other sites More sharing options...
bear Posted August 31, 2009 Share Posted August 31, 2009 I'd like to point out that although there is little chance of data being intercepted during transit generally over the Internet Very false. Packet sniffers, unscrupulous ISP employees and more monitor "pinch points" for unsecured data that might contain things to steal. Normal traffic isn't likely to be a target, but hosts, DCs and other likely points for CC details and things of that nature are often targeted and monitored. I'd also mention FTP details, that are often sent in plain text unless using SFTP. Spammers and phishers and so on love to gain FTP details. I'm surprised no one here has mentioned wireless, which is like being on a hub, only more open. Same as with Cable internet. Technically, you're on a huge LAN, and anyone downstream of your AP can monitor packets if they know what they're doing Heh, its technically about SSL, which for all I care, could mean encryption your porn stash using SSL. As an FYI, SSL doesn't encrypt files, it encrypts connections between computers/servers. 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.