To protect your credit card, I use SSL (secure sockets layer). You can tell when a page is secured in this way. Different browsers use different ways to show this. Firefox puts a green lock icon on the URL bar. Chrome a green lock icon on the URL bar, and the word "Secure". Opera shows a grey lock icon and the word "Trusted". Your browser might have a different way to show it.
In addition, I use SSL for the other pages of the web site. I dn't think there'a really compelling reason to do this, but this is how the web is going increasingly, and I see no reason for not doing that. So you 'll see that little lock (or whatever it is that your browser shows) on most of my pages.
So what is this security? Nerds call it a dual key crypto system, or a public key crypto system, and start wittering on about RSA and the mathematical intractibility of factoring very large primes. If you're interested in that stuff, go read up about it, it isn't that complicated, although naturally they try to make it sound difficult.
Here's how it works. It's like the front door to my house - anyone can close and lock it just by pulling it closed, but I'm the only one who can open it because I'm the only one with the key. So, you type the data into the input screen - name, address, credit card number and so on. Then, your browser (if it has the ability to do this, like Netscape and Internet Explorer do) encrypts all the data (like you locking my front door by closing it). And what is sent across the internet is unintelligible garbage (as is so much of what I read these days).
When it reaches my server, the software running here decrypts all the data (like putting my front door key in the lock, and I can open the door). The data gets sent to the server, and periodically, I takes that away to a computer that is behind a firewall and that's where all the serious processing is done.
Very few people ever explain this stuff to you - one suspects it's because they don't understand it themselves. Maybe they got a Valkyrie to do it for them.
You heard wrong.
I was at a party recently, and I got surrounded by a bunch of experts who insisted that this was true, all you need is to put a big computer on it with a lot of processing power, so I finally got fed up with explaining the theory of all this to them, and said, "OK, I'll prove it, I'll write down an encrypted message and you tell me if it can be broken by giving it to a computer with lots of processing power". And I took a piece of paper, and I wrote down the letter G and I said to them "OK, decrypt that then".
And of course, you can't. That G might have meant anything. It might have meant "I'd like a small dry sherry, please" or it might have meant "Your trousers are too tight". Next time some expert tells you that any encryption system can be broken, you write down the letter G for him, and tell him to go away and not come back until he's worked out what message it represents.
And if he says "That's unfair", then you say "No, that's called a trapdoor crypto system", you can encrypt things but you can't decrypt them. And tell him to go research about one-time-pads, another unbreakable crypto system that isn't a trapdoor system.
By the way, if you ever want a good crypto system for sending secret messages to people, go get PGP (Pretty Good Privacy), it's the bees knees. Or GPG.
By the way, they asked me later what the message was. And I didn't tell them.
Here's how you find out whether an encryption system can be broken. You publish how it works, and you get all the academics all over the world to try to find a way into it. And they try really hard, because they'll have a great reputation if they succeed, maybe get promoted to deputy assistant professor. And when none of them can succeed, you know you've got a good strong system. It's a bit like testing the strength of footballs by giving them to a Valkyrie to burst between her thighs, except that footballs aren't designed to stand up to that sort of pressure.
What I'm using here is a system that's been tested like that, for several years.
OK, then don't send it over the internet. Use one of these payment methods, like sending it through the mail.
And remember - I don't keep your information on anywhere on the servers that run the web site, it's on a different computer.
Sigh.
It isn't my certificate that expired. It's yours. I'll explain.
This security thing is done with a chain of trust. You trust your browser, because you trust Microsoft or Netscape. And built in to your browser (as a root certificate), is a list of Certifying Authorities, like Verisign and Thawte, which you can trust because Microsoft and Netscape say you can. And I use a certificate from Thawte, and that certificate says you can trust me to be who I say I am.
The problem is, if you're using an old browser, then the root certificate expired. When it expired, depends on what browser you're using. If you're using Netscape 4.5 or newer, or Microsoft Explorer 4 or 5 or newer, then your root certificate expires some time in the future, so you're OK how. If you use Netscape 3, then the root certificate for Thawte expired in July 1998. If you're using Netscape 4, then the root certificate for Verisign expires 31 December, 1999 (great choice of expiry date, Verisign!)
So what should you do? Well, you could ignore this, but that's a bit like ignoring a dog barking. If you ignore the dog barking every time, then one day the dog will bark because you're being burgled, and you'll ignore that, too. In this case, you can safely ignore it, because the encryption still is as strong as it is with a current root certificate. All you're losing, is the assurance from the certificate (from Thawte, in my case) that this site *really is* my site, and not just a site that says it's my site.
Or you can upgrade your browser. Get the upgrade from wherever you usually get your browser software. That's the option recommended by Thawte and Verisign, who possibly haven't experienced the fact that if you upgrade software, then you stand a good chance of finding that suddenly various things that used to work, don't work any more.