3 ms·
Not true. E-commerce did just fine even without TLS in the past. Also most of the e-commerce features don't really need encryption, but authenticity. That can
by megous 6y ago
Not true. E-commerce did just fine even without TLS in the past.
Also most of the e-commerce features don't really need encryption, but authenticity. That can be achieved with just asymmetric crypto and signing, but payloads can be in the open.
Encryption is only needed for privacy.
- neilalexander 6y ago> E-commerce did just fine even without TLS in the past You know what else was easy in the past? Wiretapping, MITMing and network-level surveillance. Moving back to sending credit card numbers and personally-identifiable information in plain-text would be the absolute death of e-commerce.
- orev 6y agoThere was no e-commerce before SSL. That was a huge thing and one of the main driving factors for all e-commerce sites to get certificates, display all those “trust” badges, etc. Most people buying things online would prefer to keep their credit card information private.
- megous 6y agoAlmost no e-commerce solutions handled credit cards. That was done by bank payment gateways. Anyway, most people didn't use credit cards either (and still don't), preferring wire transfers, because they felt they had more control over those (instead of giving someone info they could use to take money from the card at any time, they'd initiate and control the transfer themselves - push vs pull approach). Times changed since then, but there was little financial risk to buyers from e-commerce not being encrypted at the time. You seem to be assuming some US situation, where using credit cards online and handing card details to actual e-commerce websites was/is maybe more common. But this article you're commenting under is about EU and I'm providing an experience from one of the EU member countries. So US situation is not relevant.