secure transmission from a form

what about encryption of emails from a form

[afallach]

I want to put up an event registration page, which will communicate a lot of information about the registrant, including credit card numbers. I (think I) understand how, once a user has filled out my Web form with his/her CC information, that is transmitted from the browser to my hosting company's server securely through SSL. But I'm getting conflicting information about how I obtain that information securely from the host.

One tech support person told me that SSL sends the email to me securely, and I'll see it in Outlook just like any other email.
Another person (same company) says I need email encryption, which they don't support.
A third says I need some sort of php script to do the encryption, but couldn't tell me anything about how to decrypt it.
An outside source told me any Web host should be able to help me with encrypting/decrypting mail sent from a form.

I'm very confused. To receive email securely in Outlook from a web form, what do I need to do?

[rocknbil]

The first message is absolutely incorrect, mail servers are not secure and the message can be intercepted in transit. Even if the sending server is secure, what guarantee do you have that the recipient is?

The only way to securely transmit email (I know of) is with GPG or PGP encryption keys. A public key exists on the server and encrypts the data prior to sending. Your public key decrypts it prior to opening. I believe Outlook does support decryption.

Although this method is secure, doing so would still violate your merchant account contract.

The proper way to do this would be to process CC info through a third party gateway account.

[Corey Bryant]

The SSL cert only encrypts the information between the browser and the server.

Using PGP, you might be OK with some merchant account providers. Just ask them - some understand that it is secure and will support you. I would consider getting PCI compliant as well though.

You might consider using a gateway that will do a pre-authorization and this will hold them money for a few business days.

-Corey

[lorax]

>> Using PGP

And the recipient must also have PGP installed to decrypt the message.

What I suggest you do is to build a secure Admin area and log the transaction details in a database. Then have the form notify you when transactions occur. Then you can access the admin area after being notified and get the information to complete the transaction.