I am wondering how grooveshark gets around it.

They accept credit cards over a connection that is not encrypted via https.

Is there something they do to make this safe, or should I not submit my credit card details to them when purchasing a grooveshark anywhere subscription?


The transmission of your credit card information does happen over HTTPS. If you use a network logger like the one included in Google Chrome's dev tools, you'll see that the request you send that actually includes your personal information is sent to an https:// URL.

However, that is only half the story: the form page where you input that information is not sent over a secure connection. While encrypting your actual credit card information is sufficient to protect you from a passive network eavesdropper (and enough to satisfy relevant credit card laws and regulations), it's not enough to protect your information from an attacker who can manipulate Grooveshark's page data in transit. Imagine this scenario:

Grooveshark sends off an HTML page with a form, so you can input your credit card info. The code on this page will submit your credit card information over HTTPS, securely, back to Grooveshark. However, an attacker intercepts the page before it gets to you and changes the code on the page to send your credit card information to a different destination (presumably, one controlled by the attacker).

A real-world analogy would be if I ran a magazine and gave out special secure envelopes with my address on them to you could send money to apply for a subscription. Instead of distributing them in a secure fashion, I leave them out in public for anyone to take. Then, some evil person comes along and changes the submission address printed on my envelopes to his own home address, so when someone mails in a subscription, it goes to him instead.

Is someone actively tampering with your Internet connection? Probably not, but it's regrettably impossible to say for sure, since your Internet messages a relayed over countless hops on an infrastructure not originally designed with security in mind.

| improve this answer | |

Accepting credit cards require https, so they possibly only use https when you click submit. You can check this by viewing the page source and looking to where the form is being submitted.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.