Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I’m PHP developer and I know very little when it comes to https/ssl, but I would like to offer my client safest possible way of uploading file to webpage (i.e. webftp as part of client service on page).
Which way should I look?
Thank you in advance, I will clarify my question if needed.
I’ll probably disappoint you, but without HTTPS or some other form of encryption, all the data passing over the wire is plaintext – this also holds for FTP. (In other words, it’s practically impossible to verify that the data which the server has received actually came from the client, and hasn’t been modified.)
Valid (and widely accepted) HTTPS certificates are cheap and relatively simple to use, plus it’s probably the optimal solution currently available in terms of safety*simplicity (switch URLs from HTTP to HTTPS, no other configuration required from end user). With a valid SSL certificate, the client could be reasonably sure that they’re communicating with your site and that the data is encrypted while in transit.
In other words, there are safer (but more complicated) alternatives (such as encrypted VPN), and there are simpler (but less safe) alternatives (such as plain HTTP). HTTPS done right is about the right combination of safety and simplicity for a general-purpose website. (OTOH, if you’re trying to protect top-secret NSA files, HTTPS is definitely not enough)