Zen Cart Logo
Forums / Built-in Shipping and Payment Modules / Unencrypted.... isnt that dangerous?

Unencrypted.... isnt that dangerous?

Locked

Views: 1,873

Results 1 to 5 of 5
This thread is locked. New replies are disabled.
16 Aug 2008, 3:44 PM
#1
zesty avatar

zesty

New Zenner

Join Date:
Aug 2008
Posts:
9
Plugin Contributions:
0

Unencrypted.... isnt that dangerous?

We have our store running through a shared SSL ticket. We are also using a paypal merchant account. However we get this message
"The seller accepts encrypted website payments only. You cannot pay the seller through unencrypted buttons"

I know the solution is to turn off that one option in paypal, but wouldnt that make it very unsecure and susceptible to people stealing information????
I feel like that might be a bad idea.. unless im misunderstanding something.

I also realize if I want it on I have to use paypal express (Right? I think I read that somewhere).
What is paypal express and how is it different?

17 Aug 2008, 12:23 AM
#2
zesty avatar

zesty

New Zenner

Join Date:
Aug 2008
Posts:
9
Plugin Contributions:
0

Re: Unencrypted.... isnt that dangerous?

no replies? i feel like this is a really easy question...........

17 Aug 2008, 1:20 AM
#3
stevesh avatar

stevesh

Black Belt

Join Date:
Feb 2005
Location:
Lansing, Michigan USA
Posts:
19,793
Plugin Contributions:
2

Re: Unencrypted.... isnt that dangerous?

Things tend to be a little slow here on the weekends, especially this time of year.

I don't use PayPal, so I can't answer your specific question, but I can offer some advice.

Dedicated SSL certificates are cheap enough that it really doesn't make any sense to use a shared cert.

Many of your customers will notice the difference in URL's, too.

17 Aug 2008, 1:29 AM
#4
zesty avatar

zesty

New Zenner

Join Date:
Aug 2008
Posts:
9
Plugin Contributions:
0

Re: Unencrypted.... isnt that dangerous?

heh thanks for the tip. we plan on buying one a lil later, we just wanted to get the bugs worked out.

17 Aug 2008, 3:37 AM
#5
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Unencrypted.... isnt that dangerous?

Zesty:

We are also using a paypal merchant account. However we get this message
"The seller accepts encrypted website payments only. You cannot pay the seller through unencrypted buttons"

I know the solution is to turn off that one option in paypal, but wouldnt that make it very unsecure and susceptible to people stealing information????
I feel like that might be a bad idea.. unless im misunderstanding something.

I also realize if I want it on I have to use paypal express (Right? I think I read that somewhere).
What is paypal express and how is it different?
PayPal's "encrypted website payments" is used to secure the "paypal buttons" that one would put on their website if they were using paypal's own shopping cart to sell products from their store. Zen Cart doesn't use PayPal buttons. The purpose of the "encrypted buttons" is to prevent your PayPal account's email address (which identifies your account so PayPal knows whose account to send the money to when someone clicks on the PayPal button) so that spambots can't take the email address and misuse it by sending junkmail, etc.

The PayPal buttons method of sales is not what Zen Cart uses. However, the PayPal IPN (which is also known as Website Payments Pro) module uses the same part of PayPal's servers in order to process payments. Thus, if you intend to use the PayPal IPN payment module you'll need to turn off the Encrypted Website Payments option.

Or you can leave the Encrypted Website Payments option enabled, and turn off your PayPal IPN (Website Payments Standard) payment module in Zen Cart, and instead turn on PayPal Express Checkout.

Express Checkout uses a more secure and more reliable method of submitting transactions to PayPal. It also lets the customer choose their PayPal details earlier in the checkout process and therefore actually finish the transaction on your site.

Website Payments Pro (which has a monthly fee) allows you to take credit card payments directly on your website without people even knowing that PayPal does the processing in the background. This is only available in a few countries at the moment.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.