Hacker News Reader

Comment by gruez | Hacker News Reader

>If the web didn't have HTTPS, it would be illegal to conduct sensitive business over it.

Source? According to this timeline[1], e-commerence with credit cards predate SSL. Therefore I'm not really convinced that there's some law against it, except for laws that were introduced after SSL was a thing.

[1] https://en.wikipedia.org/wiki/E-commerce#Timeline

View on HN

...and why would there be? People are free to be stupid if they want.

I really hate this attitude that every little danger has to be regulated.

E-commerce predates opening The Internet for commercial entities. In 1988 or 89 I ordered some Unix book, maybe the 4.3BSD daemon book, via email that I got from Nyx, which was a dialup Usenet server at University of Denver. Sent a credit card number over SMTP email.

I remember "buying" something online and having to physically mail a check with the order # on the info line.

Been there, done that. Also sent a credit card number split across two emails “for security.”

It's not so much law, as far as I'm aware, as the PCI/DSS requirements made by the credit card companies. Since they'll stop doing business with you if you don't follow their requirements, for all practical purposes, they have the force of law.

You could probably get sued for negligence if you process card details over an unencrypted connection, but that's nothing compared to the damage your business will take if the card companies decide that you're on the naughty list.

Sure, since we do have TLS on the web card companies can require we use it. That doesn't mean that they would just disallow all online transactions if we did no have easy encryption available. Security is after all never the primary concern - if it was you would not interacting with other people and computers at all.

Reply on news.ycombinator.com