Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering how grooveshark gets around it.

They accept credit cards over a connection that is not encrypted via https.

Is there something they do to make this safe, or should I not submit my credit card details to them when purchasing a grooveshark anywhere subscription?

share|improve this question

closed as off-topic by Alex, Eight Days of Malaise, Al E., jonsca Jun 20 '15 at 7:35

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on applications or application features that are no longer available are off-topic for Web Applications as no one will ever be able to make use of the answers again." – Alex, Eight Days of Malaise, Al E., jonsca
If this question can be reworded to fit the rules in the help center, please edit the question.

The transmission of your credit card information does happen over HTTPS. If you use a network logger like the one included in Google Chrome's dev tools, you'll see that the request you send that actually includes your personal information is sent to an https:// URL.

However, that is only half the story: the form page where you input that information is not sent over a secure connection. While encrypting your actual credit card information is sufficient to protect you from a passive network eavesdropper (and enough to satisfy relevant credit card laws and regulations), it's not enough to protect your information from an attacker who can manipulate Grooveshark's page data in transit. Imagine this scenario:

Grooveshark sends off an HTML page with a form, so you can input your credit card info. The code on this page will submit your credit card information over HTTPS, securely, back to Grooveshark. However, an attacker intercepts the page before it gets to you and changes the code on the page to send your credit card information to a different destination (presumably, one controlled by the attacker).

A real-world analogy would be if I ran a magazine and gave out special secure envelopes with my address on them to you could send money to apply for a subscription. Instead of distributing them in a secure fashion, I leave them out in public for anyone to take. Then, some evil person comes along and changes the submission address printed on my envelopes to his own home address, so when someone mails in a subscription, it goes to him instead.

Is someone actively tampering with your Internet connection? Probably not, but it's regrettably impossible to say for sure, since your Internet messages a relayed over countless hops on an infrastructure not originally designed with security in mind.

share|improve this answer

Accepting credit cards require https, so they possibly only use https when you click submit. You can check this by viewing the page source and looking to where the form is being submitted.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.