Forum Moderators: phranque
Every order must be verified in stock before a charge can be made. The company wants a way for customers to rent online but their budget is very minimal.
The company that under bid me is pretty shady. They want to set up an email form to submit the order and credit card info. They stated on their proposal that the company would be charged $200 dollars for an ssl certificate. I don't understand sercurity very well but I thought you needed digital keys for encrypted email. I thought the server needed the certificate. How would you post an encrypted email from a server to a remote client? What would you need?
I was going the https certificate route with email notification of the transaction, and have the person who got the email securely login to the site and authorize the order. Then charge the card. Would there be an easier way?
You need an ssl connection so the form the customer fills out is sent encryted on the web.
Once the server receives and parses the form data it can either store it on the server, or email it to someone who can process the order.
EITHER WAY, the data MUST be encypted before storing or emailing. This requires an encryption executable such as PGP or GPG.
The answer is, you need both, an SSL connection and an encryption program.
Some HOSTS will provide use of their certificate for SSL transactions. They usually charge by the month for this service (about $20 a month). Some HOSTS also have a PGP or GPG executable you can use. If you find a host which can provide both features, you can provide a simple ordering system very inexpensively.
-Marty
Anyway, an affiliate brought his certicate (dot.za) $50.00 US and as I understand this is a common practice.
A friend, an ITI graduate had to design an encrypted e-mail account for a point-of-sale terminal (offline credit card debit). She did it very easily and got a free certificate from a local university.
Have a client that uses JavaScript and FTP with SSL and password protects the .pl directory.
Are they shady... maybe, but that should be the company's concern I would think?
My humble opinion
I always heard you never really want to send cc info through email. I have a host that supports ecom with certificate. Thats how my programmer was going to get it done. He is the one who told me that to create an encrypted email on the fly is very intensive. There bid was very low(>1000) for a total site redesign (30 pages) and adding ecom.
I just want to make sure they don't get ripped off.
I then went into Yahoo, did a search for attorneys (her business), and started clicking. Guess what - everything this kid was passing off as his own work was stolen - images, copy and all - from other legal sites.
He would literally steal an entire site, and pass it off as his own.
Don't know if you will find that to be the case for you, but that price seems so ridiculously low that:
A) - the designers can't possibly plan on making any money OR staying in business and
B)The chances that there will be "original" creative involved are slim and none.
Good luck. Hopefully your client puts a premium on relationships and quality, and understands that in web design and everything else, "you get what you pay for."
if you go the SSL route, there will be an annual fee for the certificate, plus extra development costs, plus extra security measures, plus the cost of the time to process each transaction - if there are a lot of transactions, the client will be spending a lot of time processing them manually or paying someone to process them for him.
with a card processing company, there will be an annual fee in place of the SSL fee, lower development costs as integration is quicker, fewer security issues, and all transactions are processed automatically, therefore saving the client the time costs of manually processing the transactions.
all card transactions, whether via SSL or via a card processing company will incur transaction fees. using a card processing company need not cost more than bank merchant transaction fees, and the time saving makes it very worthwhile.
if you want more specific information, sticky me with details etc.
