SSL needed for PayPal / no SSL for cc ?

[Wils]

A few questions:

(i) Does PayPal require that one uses SSL? I know that one should, but getting it going or changing hosts can be a lot of work and expensive.

(ii) Anyone know of a cc payment module/company that has a "secure" payment procedure without SSL?

(iii) Any known sequrity concerns with the built in credit card module in Zen-Cart? Anyone using it who has comments/experience?

All input appreciated.

[Ryk]

1. The SSL is at the Paypal end where the transaction takes place.

2. Yes - #3!

3. Not as far as I'm aware.

BUT you really should consider that the shopping population on the 'net is becoming more aware, and the lack of SSL when they're supplying you with personal details will be a deterrent.

There are some costs you really have to accept if you want to make a go of your business....SSL is one of them. It also helps you look professional.

[Adaire]

The personal details that are being given to you by the customer when you are using Papal are no more sensitive than what can be found in the phone book. SSL slows down your cart considerably. The default setting in most browsers, is to not have anything cache from secure pages. The encryption causes everything in the browser to run like cold honey. The big problem is that your average user doesn't understand this (well apparently not many tech support people either) so you have to point this out in a friendly and short paragraph. Don't get suckered into an SSL cert if you don't have to. My host charges $25.00 just to install one if I already have it.

[DrByte]

The personal details that are being given to you by the customer when you are using Papal are no more sensitive than what can be found in the phone book. SSL slows down your cart considerably. The default setting in most browsers, is to not have anything cache from secure pages. The encryption causes everything in the browser to run like cold honey. The big problem is that your average user doesn't understand this (well apparently not many tech support people either) so you have to point this out in a friendly and short paragraph. Don't get suckered into an SSL cert if you don't have to. My host charges $25.00 just to install one if I already have it.

While there's some truth to your comments, look at it from another angle... security is your friend when it comes to e-commerce. If customers don't feel secure, they won't buy. If you aren't protecting data and you end up with any sort of lawsuit, you don't have much to stand on. Gosh, an SSL certificate doesn't have to be expensive, nor does the installation or hosting related to it. By all means, don't pay more than you have to, but don't skimp on security just to save a couple bucks. Besides, you can write it off as an expense anyway. It'll save you in the long run .... and, depending on what you're selling and who you're selling to, it'll MAKE you more sales, which theoretically should MAKE you more money...

By the way, check out the laws in your geographic region and the regions where your customers come from, to determine whether there are legal requirements for protecting customer data. And, state ALL the details of your privacy policy ON your site. If you are protecting customer data, say so. If you're not, say so. Or at least get your attorney to write up the politically correct wording. (That'll cost a ton more than an SSL certificate, by the way.)

[golowenow]

was reading this and another point on SSL certification is that you CAN make your own SSL certificate for free and SSL will work perfectly although it will warn the customer that the certificate is not from a "PAID FOR" issuer. Advise is to post on your site information telling the customers that you are the creator of the certificate. I have done this for years and tell the customers that I do NOT BELIEVE in paying someone for the certificate when I can do such a simple thing for free. I run STunnel on my sites. Get all the details and the program from their website at http://www.STunnel.org

[Merlinpa1969]

and while what you are saying about a self signed cert is true,
its really amazing how fast people hit the close button when that warning popups, up.

[Ajeh]

I get secure page warnings and pack up my credit cards and go home ...

[Gerard]

No SSL , No Sale. Think of it as the electronic version of a prophylactic

Gerard

[golowenow]

Have made plenty of sales. I use PayPal. Their cert is paid for. Mine is for my site only and I do not accept credit cards or payments directly on my site at all.

[Merlinpa1969]

I didnt say it wasnt secure,
I just know for a fact that popups scare people,