3 ms·

No, not really. It's the wild west. SSL certs don't do anything to prevent SQL injection. That's done at the application layer, not the transport layer. You

No, not really. It's the wild west. SSL certs don't do anything to prevent SQL injection. That's done at the application layer, not the transport layer. You seem to be out of your depth. This is equivalent to "checking to see if the door is unlocked when it should be locked" not "trying to pick the lock after hours"

Consultant32452 12y ago
I'm not out of my depth, this is what I do for a living. Verifying that a site is using valid SSL is one of the myriad of tools at your disposal to make sure a site is taking reasonable safety precautions with your data. That, accompanied by a third party trusted certification that indicates some basic penetration testing has been performed is reasonable protection for almost any data you'd be putting on the internet.
- emn13 12y ago
  If you think that verifying that a site is using valid SSL is a tool to make sure that a site is taking reasonable safety precautions with your data, you most definitely are entirely out of your depth. As to trusted certification - please elaborate; because many of these "certifications" are entirely worthless (some indeed indicate that a site is less likely to be safe).
  - msandford 12y ago
    Yeah, it's like driving by a house and seeing a sign on the lawn "This house is protected by Brinks" and from that concluding that none of the doors or windows have been accidentally unlocked. It does show some kind of theoretical preference for security but it by no means assures one -- nevermind making any kind of a guarantee -- that said preference has been successfully translated into reality. I would suspect that the rate windows or doors left accidentally unlocked between houses with security systems and without isn't a substantial enough difference to be meaningful. Sure the right might drop in half, but if it's from 4% to 2% that doesn't do much. Having an SSL certificate is really the bare minimum that someone can do to have even a hope of a prayer of keeping data safe. There are about a dozen steps beyond that which must be taken. Worse, the effects are not additive, but multiplicative. If any one particular defense is handled improperly the properly handled other portions lend little/no assistance. Naively one might assume that the total security score might be tabulated this way: ( 1 + 1 + 1 + 0 + 1 + 1 ) / 6 = 0.833 But in fact, it's this way: 1 * 1 * 1 * 0 * 1 * 1 = 0

Consultant32452 12y ago

I'm not out of my depth, this is what I do for a living. Verifying that a site is using valid SSL is one of the myriad of tools at your disposal to make sure a site is taking reasonable safety precautions with your data. That, accompanied by a third party trusted certification that indicates some basic penetration testing has been performed is reasonable protection for almost any data you'd be putting on the internet.

emn13 12y ago
If you think that verifying that a site is using valid SSL is a tool to make sure that a site is taking reasonable safety precautions with your data, you most definitely are entirely out of your depth. As to trusted certification - please elaborate; because many of these "certifications" are entirely worthless (some indeed indicate that a site is less likely to be safe).
- msandford 12y ago
  Yeah, it's like driving by a house and seeing a sign on the lawn "This house is protected by Brinks" and from that concluding that none of the doors or windows have been accidentally unlocked. It does show some kind of theoretical preference for security but it by no means assures one -- nevermind making any kind of a guarantee -- that said preference has been successfully translated into reality. I would suspect that the rate windows or doors left accidentally unlocked between houses with security systems and without isn't a substantial enough difference to be meaningful. Sure the right might drop in half, but if it's from 4% to 2% that doesn't do much. Having an SSL certificate is really the bare minimum that someone can do to have even a hope of a prayer of keeping data safe. There are about a dozen steps beyond that which must be taken. Worse, the effects are not additive, but multiplicative. If any one particular defense is handled improperly the properly handled other portions lend little/no assistance. Naively one might assume that the total security score might be tabulated this way: ( 1 + 1 + 1 + 0 + 1 + 1 ) / 6 = 0.833 But in fact, it's this way: 1 * 1 * 1 * 0 * 1 * 1 = 0