The first thing I'd think of with a site asking for SSN is an active intent to commit fraud: ID theft, or fraud. That's before SSL (which is obsolete anyway, on

The first thing I'd think of with a site asking for SSN is an active intent to commit fraud: ID theft, or fraud. That's before SSL (which is obsolete anyway, only TLS should be considered now). The second thing, the fact it's http and not https suggests he's collecting and storing this information, which is almost certainly a violation of his credit card agreement with his bank. Credit card information is not supposed to be stored, he passes that off through a secure connection with his processing service, who will only do that through a secure connection, and he gets a transaction ID and authorization and that's all he references from that point on. So this is less about SSL/TLS as it is, he's doing it all wrong. And it's depressing that he's in business, only made possible by the ignorance of his customers who actually agree to give him all of this information, and on an insecure connection no less.