Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's justified, really!) I'd need one of those expensive certificates that cover subdomains.

As I'm doing this out of my own time and money, so I'm hesitant to drop a couple of hundreds on a certificate, plus a couple of hours delving into something I haven't tried before. I'm not storing any sensitive information besides the email address and the password. As far as I understand, the only vulnerability happens when a user logs or signs up from an unencrypted network (such as a coffee shop) and someone is listening the network.

Am I being cheap? Is this something I should tackle before releasing into the wild. I probably should mention I have 25,000 users signed up to be notified when I launch, so I'm nervous about it.

share|improve this question
1  
Because he needs a wildcard certificate to cover his sub-domains. –  pritaeas Jul 18 '12 at 9:22
1  
But are the subdomains really necessary? Is it possible to put some kind of (secure) proxy in front of them all to make it look like a single site? –  Donal Fellows Jul 18 '12 at 11:36
2  
If you have 25,000 users waiting for your launch, then spending some hundreds of dollars should not be a problem. –  marco-fiset Jul 18 '12 at 12:23
1  
Despite a lot of the answers and comments, a Signed SSL certificate is an essential part of securing the data on your website. Anything the user sees or submits can be spied on if you don't have one, regardless of where they connect from. –  Chris Jul 18 '12 at 14:56
2  
@RyanKinal Uhh... those actually work and validate correctly on standard browsers? I would of thought any CA that offered certs for free would have its signing key blacklisted –  TheLQ Jul 18 '12 at 18:24

10 Answers 10

up vote 21 down vote accepted

I'd buy one. The cost of the certificate is not that big considered the level of trust it provides to the users. Think of it as an investment. If your applications don't seem to be secure (and properly signed SSL certificates give assumption that a website is secure) people may lose interest in using your future products.

share|improve this answer
2  
+1 for the trust issue. –  pritaeas Jul 18 '12 at 9:20
1  
overall SSL is a 'feel good' for non-tech folks –  Jakub Jul 18 '12 at 14:08
    
and on the other side: no SSL is a 'feel very bad and suspicious' for the typical user –  Andrzej Bobak Jul 18 '12 at 14:11
    
Only signed certificates can provide trust. It's possible to still have data stolen without a signed certificate. Man in the middle attacks still work by providing a false certificate to the client. –  Chris Jul 18 '12 at 14:54
    
Thanks for the pointers, the general consensus seems to point that an SSL is not something I should skim on. I've installed a free certificate from StartSSL and will buy the wildcard one when I actually launch method.ac –  Duopixel Jul 18 '12 at 17:53

It would be wise to buy one. As mentioned, it is ALL about end user trust to your website.

so I'm hesitant to drop a couple of hundreds on a certificate - well it is not expensive and you may get one under $50.

SSL - is really important to secure your site and add a level of confidence to the visitors in your site. In regards to the login process, why NOT to use OAuth ? This feature will skip the user hassle to spend time in registration for your website. Website user traffic will really benefit from that. Seriously!, find some time to research it.

A good reference on common SSL questions - All about SSL Certificates

share|improve this answer

It's all about the users, they do not provide any kind of security, the certificates are just products to sell.

You may want to take a look at this

http://en.wikipedia.org/wiki/Comparison_of_SSL_certificates_for_web_servers

share|improve this answer
    
I don't think what you are saying is right. A certificate does not provide security, but it an identity, and being able to identify objects is the first level of security? –  Ozair Kafray Jul 18 '12 at 11:23
    
identify who? how? if you have a company named "Stuff" you buy a certificate and you are recognized as "Stuff", period. if you say that you are "Random" you are recognized as "Random"; do you think that this guys have a minimal interest in being police mans over the internet? –  user827992 Jul 18 '12 at 11:26
    
No, but we recently bought a certificate for our product vcred.com and, geotrust took 3 months to verify us as a company which is riksof.com. That is for Pakistan, for other countries they take less time, and that is because they verify us. I think verisign would also have a stringent verification process. So, they are not selling it just as a product in my view. One can generate a certificate himself also and then the absence of CA is easily identified –  Ozair Kafray Jul 18 '12 at 12:04
    
this company are an exception, also it depends on what kind of certificate you are buying, but in the end you can just be another person and it's not that hard to achieve that. –  user827992 Jul 18 '12 at 12:07
    
-1 Certificates provide security. That's their primary function. –  Chris Jul 18 '12 at 14:48

If you are "only" gathering e-mails and passwords you maybe want to try creating your own certificate OpenSSL (http://www.openssl.org/) before committing any funds.

But...

This is just something you can do to "try things out" because website users will get a warring as this will not be a recognized/accepted certificate.

My advise is to invest in SSL, simply because email and passwords are a very sensitive private data that can lead to other kind of exposures (say I use the same pass for my email account - if this info leaks out, then all e-mail data is exposed, including CC data, any and all access info I have for other online services and god knows what else...)

We need a secure and trustworthy WEB and few dozen bucks is a small price to pay for user security. (even as basic as SSL)

share|improve this answer

An SSL has drawbacks. It slows down your website. Really.

The only reason why people are using SSL certificates is when there is the customers' money involved.

If you are not involving your customers' money, the decision to take an SSL certificate is purely business oriented.

If you're having a backend for your customers, with no money involved on the website, but they need to be sure that they're secure, then sure take a certificate. It's an investment for your customers' trust.

share|improve this answer
1  
-1 : You must ALWAYS use an SSL certificate when your users submit sensitive data like passwords for registration and login. Not just when money is involved. –  marco-fiset Jul 18 '12 at 13:27
2  
I disagree. From a business point of view, it is clearly not needed. Only buy an SSL certificate if, as said in the answer, you're involving the customers' money. –  Florian Margaine Jul 18 '12 at 13:32
    
@marco-fiset: s/ALWAYS/usually/; for a rinky-dink blog or something it might not be worth it (and you might not even be able to get SSL support), but for a professional corporate site it's a must. Even when there's no money changing hands. @Florian: If someone manages to get a hold of that password the user used to log in, or a bunch of their personal info, then you are the one responsible. If they get their identity stolen because of it, and it's shown that you didn't treat that data with the care it deserves...oooboy. –  cHao Jul 18 '12 at 13:44
1  
@Florian: SE is a broken website, if it asks you for personal info but doesn't encrypt it. A site network this huge, particularly one directed at programmers, should know better. For me, though, they redirect to my OpenID provider, which BTW does use SSL. The question is whether that brokenness is worth fixing. And for a site like SO that doesn't really have any personal info (aside from password and email address), maybe they've decided it isn't. But that's a decision that has to be made and lived with, rather than just saying "no CC numbers? then screw SSL". –  cHao Jul 18 '12 at 14:58
1  
I was fooled by the the lack of SSL too, but it turns out the sign up form is actually embedded in an iframe that calls an https address. –  Duopixel Jul 18 '12 at 17:50

I would also think about using a third party provider for the login (e.g. openid). Most CMS already support it.

share|improve this answer

Security Concerns

As far as I understand, the only vulnerability happens when a user logs or signs up from an unencrypted network (such as a coffee shop) and someone is listening the network.

This is not true, data transmitted between the user and your website is never safe. Just as an example, http://www.pcmag.com/article2/0,2817,2406837,00.asp details the story of a virus that changed people's DNS settings. No matter how good your current network is protected, any submission on the internet goes through many different servers before it gets to yours. Any one of them can be malicious.

SSL certificates allow you to encrypt your data in a one way encryption that can only be decrypted at your server. So no matter where the data hops on it's way to your server, no one else can read the data.

In most cases, and this depends on your hosting, installation of a certificate is rather painless. Most providers will install it for you.

SSL Cert Types

As noted in some answers, you can create your own SSL certificates. An SSL certificate is just a public and private key pairing. Your server gives out the public key, the client uses it to encrypt the data it's sending, and only the private key on your server can decrypt it. OpenSSL is a good tool for creating your own.

Signed SSL Certificates

Purchasing a certificate from a certificate authority adds another level of security and trust. Again, it's possible that someone can sit in between the client browser and you web server. They would simply need to give the client their own public key, decrypt the info with their private key, re-encrypt it with your public key and pass it on to you and neither the user nor you would know.

When a Signed Certificate is received by the user, their browser will connect to the authentication provider (Verisign, etc.) to validate that the public key they received is in fact the one for your website and that there has been no tampering.

So, yes you should have a Signed SSL certificate for you site. It makes you look more professional, gives your users more piece of mind in using your site, and most importantly protects you against data theft.

More info on the Man In The Middle attack that is the core of the issue here. http://en.wikipedia.org/wiki/Man-in-the-middle_attack

share|improve this answer

Passworrds should be treated as personal information -- frankly given password reuse, it is probably more sensitive than a SSN.

Given that and your description, I wonder why you are storing a password at all...

I would use OpenID and if you feel the need to have your own login, create a single subdomain for that, and use OpenID everwhere else.

If you won't do OpenID, you can still use the same login.yourdomain pattern to keep from needing a wildcard certificate, but like I said, in todays world passwords are at least as sensitive as SSN/birthday, don't collect it if you don't have to.

share|improve this answer

RapidSSL through Trustico is only $30 or you can get a RapidSSL wildcard for less than $160 - they also have a price guarantee, so if you find it cheaper they'll match it.

share|improve this answer

If you have a unique IP, you might as well get a certificate, particularly if you deal with any data that is even remotely sensitive. Since you can get free trusted certificates from StartSSL, there's really no reason for not having one.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.