How to secure contact us page with SSL?

[kuroi]

That piece of legislation is very similar to the UK's Data Protection Act, which is not a surprise, since they are the local laws necessary to enable the same European Directive.

However, we certainly don't interpret it anywhere near as tightly as you are. Indeed, from your post it sounds as though you authorities there don't either ... you're just saying that they might (even though the legislation has been in force for 11 years and they haven't).

From a close reading of the translation, I'd say that you're over-interpreting the legislation. However, if it's a real concern to you, I'd recommend that you have Philip build it into his fork.

[eentje]

No it is not enforced actively by which i mean that if your contact us pages are not secured by SSL you will not get fined or cuffed right away.

But it is necessary to get certified then they check.

There is jurisprudence that SSL is mandatory. (sorry only i can find atm are in Dutch)

And why would i want Phillip have to write that in his fork? and what has it to do with this subject? Seriously i don't get that... i might not be very active on this forum as i am mostly active on the dutch and German zen-cart fora (yes there are really people in this world that find it hard to read English especially when it comes to technical stuff)

[kuroi]

But it is necessary to get certified then they check.

Certified by whom?

[kuroi]

I've been testing this out in a few other carts. Haven't yet found one that has SSL on the contact page. Is the whole of the e-commerce world operating illegally in the Netherlands.

And what about blogs and other sites that generally don't have need of SSL. Are they all illegal too if they have a contact page?

What about comments on blogs. They typically have the same structure the Zen Cart contact us page: name, email, big text box. Are you suggesting that blogs with comments enabled are forbidden unless operating under SSL?

[eentje]

By a certifying authority which stand under supervision of the 'Raad voor Accreditatie' which has been established by the dutch ministry of economic affairs in 1981. link

To get this certification one of the rules is:

Indien een consument online persoonsgegevens beschikbaar stelt, dient het bedrijf afdoende maatregelen te
nemen voor een veilige overdracht van die gegevens. Een dergelijke beveiliging wordt bereikt door het
gebruik van SSL encryptieprotocollen of vergelijkbare encryptieprotocollen.

Translation (as good as it gets at this time of morning):

If a consumer has to make his personal data available online, the company has to take appropriate measures for a safe transmission of these data. Such measure of safety will be reached by using SSL encryption or similar encryption protocols.

I've seen several Magento shops that have it... also on a lot (most) off dutch 'rent a cart' have it (optionally).

Here is a blogpost of a leading Dutch ICT attorney.
I'm sorry it is in Dutch, this is what Google translate makes of it.

[kuroi]

LOL. The lawyer that you're quoting has a link to his contact form on that very page. And it's not protected by SSL.

His defence would most likely be that the name and address are not stored in a database (he states that clearly). The same defence would apply to Zen Cart which doesn't store data from the contact page, but instead emails it to the store owner, which is most likely what his site is doing too.

Magento Community Edition was one of the carts that I tested. It doesn't have SSL on the contact page. It's possible that the paid editions may store the data and so may operate differently. I haven't tested those.

[Kim]

According to that translation: (coloring and emphasis is mine)

Security Requirements

Companies that process personal data, should take measures (technical and managerial) to prevent unauthorized access to get people here. In many cases, it is necessary to protect such data, such as passwords and encryption to be applied to the database. For transmission of data (such as filling out forms) often use secure Internet connections using SSL as recommended.

Recommended, not required. All the other forms, i.e. Create Account and checkout do use SSL when available.

Since the Contact Us is not required information, the customer is voluntarily sending you the correspondence, it is our position that SSL is not required.

[eentje]

@kuroi

His defense is that he is blogging as a private person not as a company.

@Kim

I took the liberty to email that same lawyer and here is his response:

Beste René,

De Wet bescherming persoonsgegevens eist 'adequate' beveiligingsmaatregelen tegen misbruik en diefstal van persoonlijke informatie. Er zijn geen harde normen, dus iedereen mag zelf verzinnen hoe in zijn situatie aan die eis voldaan is.

SSL lijkt me een voldoende manier voor bestel- en contactformulieren, dus als je dat doet dan zit je m.i. goed. Wel ook je database goed beveiligen natuurlijk. Maar heb je een andere manier die ook veilig is, of vind jij dat e-mailadressen in een niet-SSL contactformulier veilig genoeg zijn, dan is er geen rechtsregel die je tegenhoudt.

...

Bij bestellingen en betalingen geldt vaak dat de payment provider SSL eist (of zelf al hanteert), dat is dan een contractuele eis waar je aan moet voldoen. Ook keurmerk Thuiswinkel.org stelt eisen waar je SSL moet hebben, en wie die niet wil opvolgen, mag hun keurmerk niet voeren.

Je mag dit publiceren op het forum.

Met vriendelijke groeten,

Arnoud Engelfriet

Tanslation:

Dear René (that's me obviously),

The Data Protection Act requires "adequate" security measures against theft and abuse of personal information. There are no strict rules, so everyone can take there own measures to how that requirement is met.

SSL seems an adequate method for ordering and contact forms, so if you do, then you meet the requirements, in my opinion. Also protect your database of course. But if you have another way to be safe, or you think that e-mail addresses in a non-SSL contact form are safe enough, then there is no rule that stops you.

...

For orders and payments, often the payment provider requires SSL (or already uses), which is a contractual requirement that you have to meet. Also mark Thuiswinkel.org makes demands that you must have SSL, and who will not succeed, can not carry their quality mark.

You may publish this on the forum.

Sincerely,

Arnoud Engelfriet

[kuroi]

All the other forms, i.e. Create Account and checkout do use SSL when available.

Just to clarify slightly ...

In Zen Cart, forms that involve the input and subsequent storage of personal, financial or security information, such as create account, the checkout process and login are protected by SSL.

forms that act as a simply front end to email, and from which no data is stored, such as contact-us and tell-a-friend don't use SSL.

We believe this to be normal practice for web applications, PA-DSS-compliant and consistent with how data protection legislation has been interpreted and applied across Europe in the decade plus since the European Directive that led to to specific legislation in individual countries was issued.

[eentje]

I actually replied to this because DrByte asked what the reason would be to secure the contact form.

At that moment I was under the impression that Dutch Law required SSL for all contact us forms (since there is a ruling that an email address is personal information) and because, to get certain quality marks you have to have the contact us secured by SSL.

From the answer of Arnoud Engelfried i now understand that is in fact not a legal requirement if you only ask for name + email address. But only if you want the dutch quality mark from Thuiswinkel.org (Thuiswinkel is dutch for homeshopping).

Therefor i thank Kuroi for post #3 and will write a description in the dutch ZC forum or a blogpost how to make your contact form SSL secured for those Zen Carts that want or need it.

Showing once again you are never to old to learn... :)