Identity Theft and SSL Certificates

The nature of web has changed over the years, and user has grown from being a passive reader to an active collaborator. We all share the contents of the virtual space, and we also share tidbits from our own personalities in this world of anonymity. As long as you remain anonymous in this data world, there is nothing to be worried about, but as soon as you start shedding your cloak you become vulnerable to identity snitchers.

The problem becomes more serious if this information shared contains our financial information or social security numbers. In this case, we become victims of primary identity theft. Download our identity theft e-book for further information on types of theft.

To a juvenile mind, there is a solution to this problem: never share any information on the Internet, come may what. I wish, if things had been this simple; it is not. What will happen to our virtual presence on social networking and social bookmarking sites, if we stop sharing information? What will happen to our decision to buy that cool book off Amazon, or purchasing those hard-to-find-in-the-market tracks from iTune store?

We got to share information, if we intend to use the Internet properly, and all the information shared is not vulnerable to phishing, and with a cautious approach you can make your information almost 100 percent secure. And at this point Secure Socket Layer (SSL) certificates come in play.

SSL Certificate: what is it?

SSL protocol was invented by Netscape to safeguard all the transactions between browsers and servers against frauds and data leakages. An SSL certificate uses a highly complex algorithm that cannot be cracked by the hackers. VeriSign is the leader and most trusted SSL certificate provider in the world.

How it works?

When you enter a website address in the address bar of your browser, the browser sends the information entered to the server requesting the desired page and in the background it also verifies the security certificate of the website; if the site you are visiting does not have a valid SSL certificate, your browser will show you a warning about either expired or invalid or wrong certificate depending upon the status of the SSL certificate.

An SSL certificate consists of a public key and a private key. The former is used to encrypt the information being sent from the user’s browser while the later is used to decrypt the received information. Once you enter your personal or financial information on a website that has an SSL certificate, the information gets encrypted as soon as you click send and remain so until it reaches the server where the information is decoded, and you get the desired result back in your browser, again following the process of encryption and decryption.

Before assigning an SSL certificate, the certificate provider like VeriSign conducts a background check of the person or company applying for SSL certificate. Once verified, the owner of an SSL certificate is given a unique ID.

How it identify?

There are two telltale signs of presence of SSL certificate in a website. One is the https:// prefix in the web address and another is the padlock icon in the status bar of your browser.

Apart from these must-have indicators of a secure site; in all most all the cases the website you are surfing must have a logo or a banner of the SSL certificate provider saying, the site is secured by xyz certificate or any similar text announcing the availability of an SSL certificate in the website, if it has an SSL certificate.

Conclusion?

If the website, you are providing your personal or financial information to, has an SSL certificate, there is no chance of any Identity theft, but if you are sharing your critical information on a web site that doesn’t have any SSL certificate, you are at risk. If you have a website and do not have an SSL certificate to provide your customers confidence that their transactions are secure, you could be losing a lot of business.  A resource we found is Gossimer, they allow their customers to purchase SSL and dedicated IP address with every hosting package.