Ron Hamilton news about daysoft contact lenses

Ron, intrigued by your new lenses and would love to have a chance to try them, however sadly when I go to order the page that takes your order details is not encrypted meaning the information is visible to others while in transit to your server.

The cost of moving this page and the link to an SSL server would be very low indeed, in fact my order and potential repeat business would easily have covered that.

Maybe I will get a chance to try the lenses once the security of the site has been looked at.

Internet security in an age of identity theft is a must for customer confidence.

All the best.

Cheers
GR

Thanks GR ... will get your observations checked and reply.
Regards
Ron

Hi Ron,

Dear GR
We are checking out improvements continuously but I attach some notes below from our IT Department which might give you some encouragement. Regards Ron

Hi Ron, We have discussed the level of security requirement many times over the years and it has always been the case that the data we handle for a customer has never been classified as being in breach of any data protection regulation. We have even changed our login from ‘email’ and ‘password’ to ‘email’ and ‘wearer password’(instead of password) to deemphasise any perceived requirement for security. We have also reduced the amount of information we pass in a confirmation email to minimise any potential concerns from customers. A confirmation email has bare order detail and no reference to any passwords (as it did in the past). All payment details are handled by WorldPay who have Secure Socket Layer (SSL certificate – https instead of http) in place. However, all that said and done we recognise changes in the world regarding identify fraud and online fraud. People are more aware of web based fraud and are more likely to query site security. We also recognise that the new level of awareness by people should not be ignored regardless of the fact we are not in breach of any data protection regulation. Regards David.

Hi Ron and thanks for the reply.

I think your IT people are confusing your companies legal obligations under the data protection act for data that you store about customers with the need for a secure method of transmitting that information to you in the first instance.

The information on your order page, prior to the request for bank details is reasonably sensitive and could be harvested by fraudsters for illegal activities.

According to Verisign

“You need SSL if...

* you have an online store or accept online orders and credit cards
* you offer a log-in or sign-in on your site
* you process sensitive data such as address, birth date, licence or ID numbers
* you need to comply with privacy and security requirements
· you value privacy and expect others to trust you.

Why Authentication Matters

Like a passport or a driving licence, an SSL Certificate is issued by a trusted source, known as the Certificate Authority (CA). Many CAs simply verify the domain name and issue the certificate. VeriSign verifies the existence of your business, the ownership of your domain name and your authority to apply for the certificate, a higher standard of authentication.

VeriSign Extended Validation (EV) SSL Certificates meet the highest standard in the Internet security industry for Web site authentication as required by CA/Browser Forum. EV SSL Certificates give high-security Web browsers information to clearly display a Web site’s organisational identity. The high-security Web browser’s address bar turns green and reveals the name of the organisation that owns the SSL Certificate and the SSL Certificate Authority that issued it. Because VeriSign is the most recognised name in online security, VeriSign SSL Certificates with Extended Validation will give Web site visitors an easy and reliable way to establish trust online. “

Maybe I am a little over sensitive to internet security concerns, however in an age where trust and business success run hand in hand, ensuring that a customers data is handled from the outset via SSL would surely be worthy of consideration.

Cheers
G Reid

Hi how about in the interim accepting paypal or Google Checkout payments, all that requires is adding one button to the site and payments can be taken that way in a secure manner.

Just a thought.

As it stands I cant place an order.

Dear GR
Feedback from our IT:
"We had planned to introduce this enhancement along many other improvements, but will now bring this forward and introduce it over the next few weeks."

Thank you for your interest in our website.
Kind regards
Ron

Ron,

I see you have added encryption to your website as stated above, many thanks for listening, I am now able to order and try out your lenses for myself, Many thanks indeed.

All the best.

Dear GR
Many thanks. We do listen to our customers. I have been away from the office for a bit ... became a Grandfather last Tuesday ... still just feel 16 but at 67 I convince no one now!
Kind regards
Ron
PS I hope you like the lenses.