encrypted webpayments

[Garyp]

Can I check please...

 

documentation says:

"If you have SSL enabled, then you won't need to set up encrypted web payments as the payment module automatically uses SSL if available."

 

I think these are different things ie customers could send a secure POST with fraudlent content especially <input type="hidden" name="amount" value="[a much lower number]"> if the button code is UNencrypted.

 

GaryP

[AlexStudio]

Can I check please...

 

documentation says:

"If you have SSL enabled, then you won't need to set up encrypted web payments as the payment module automatically uses SSL if available."

 

I think these are different things ie customers could send a secure POST with fraudlent content especially <input type="hidden" name="amount" value="[a much lower number]"> if the button code is UNencrypted.

 

GaryP

Yes, you are right. The encrypted webpayments is to protect the store, not the customers. Please by all means utilize it, don't count on the 'SSL enabled' thing, it's not enough.

[AlexStudio]

And also block unecrypted wbsite payments in profile settings. These are all stated in the PayPal's website payment standard integration guide.

 

Blocking Unencrypted Website Payments

To prevent someone from creating a “spoof” version of your Website Payment buttons, you

can block unencrypted website payments.

To allow only Encrypted Website Payments:

1. Log in to your Business or Premier PayPal account.

2. Click the Profile subtab.

3. Click the Website Payment Preferences link in the right-hand menu.

4. Select On next to Block Non-encrypted Website Payments.

- PayPal's website payment standard integration guide page 106 -