The badge looks like this:īeware that there are many other security badges merchants often put on their sites. PCI DSS compliant sites often (but not always) add badges to enhance trust. So, even if the merchant’s site does get hacked, the stolen information would be most likely useless to the hacker. It also means that all sensitive data is stored in an encrypted manner, using strong encryption.

Being PCI DSS compliant means that the merchant has a system in place to issue proper patches to vulnerabilities, ensuring that the chances of getting hacked in the first place are smaller. PCI DSS is a standard defined by the payment industry. The best indication that a merchant is secure is PCI DSS compliance. So, what can we, as online consumers, do to ensure that the merchant’s we purchase from are relatively secure, and that they’re storing our data in a responsible manner? That’s why, in many ways, the padlock icon can be misleading. Since most cyberattacks focus on what’s stored on servers rather than communication, the padlock has very little ability to truly protect our information. Yes, the information was transferred securely, but the padlock can’t secure our data if it gets leaked from the merchant. In this scenario, which unfortunately happens quite often, the padlock shown on the website didn’t help us much. If the merchant saves our sensitive information (which most do, so they can do things like issue a refund if needed, or make our future purchases easier and quicker), and if that data is saved in an unencrypted fashion (which it shouldn’t be, but often times is), all a hacker needs to do is hack into the website and steal the information which will be waiting for him in a decrypted, easy-to-read fashion.

But from that point on, it’s up to the merchant to properly handle and secure it. And that’s to be expected, since without decrypting the information the merchant wouldn’t be able to use it. However, and here lies the issue, once the information reaches the merchant, it gets decrypted.

Using SSL (Secure Socket Layer), the method represented by the padlock that’s used to encrypt communication, ensures that even intelligence agencies would find it very difficult to obtain decrypted data while sitting on the communication lines and reading the traffic.

As information passes between the two machines over the Internet-across potentially dozens of routers and links and other networking devices-without encryption there’s the dangerous possibility that someone sitting on the communication lines can read the traffic and easily steal our data. The padlock indicates that information moved from the client’s computer to the merchant’s server is encrypted. Rather, our expectations of the padlock are simply misguided. There’s nothing technically wrong with the padlock. So, what does that mean about the trusty padlock? Is it not doing its job? Our browsers, too, go to great lengths to alert us when there’s something wrong with the certificate (which is what enables encryption and results in the padlock being shown) if nothing menacing popped up during the transaction, we can rest assured everything is in order.īut, despite the fact that almost all merchants use encryption (when was the last time you bought something and the padlock wasn’t there?), identity thieves and hackers still manage to conduct major credit card breaches from online merchants. The padlock is supposed to indicate that the site is secure and we can send the merchant our sensitive information with peace of mind, since our personal information is secure. Many of us have been taught that when we’re making purchases online, we should always look for the little padlock icon on the browser’s address line.

Passwordbox safety identity theft