4 ms·

You know it. I know it. Most of HN knows it. We are, in general, not the customer. On sites I've been involved with, in 2016, I still have to fight tooth and n

You know it. I know it. Most of HN knows it. We are, in general, not the customer. On sites I've been involved with, in 2016, I still have to fight tooth and nail to get SSL on the payment page at all, let alone redirect users somewhere else.

Silhouette 10y ago
On sites I've been involved with, in 2016, I still have to fight tooth and nail to get SSL on the payment page at all I'm reasonably sure that every payment service I've ever used requires payment pages to be served over HTTPS, not just HTTP, even those that have minimal other requirements and take on most of the security burden themselves with some sort of hosted arrangement. Are there really significant numbers of merchants who aren't doing that?
- technion 10y ago
  As a low tech experiment, I just grabbed the list that started this thread and tried a few random sites. I only made it to the third one before I found an http:// http:// checkout page. I tried to change the address to https:// https:// and found it complaining about a cert mismatch. I also viewed source and confirmed the form submits to an http:// http:// address. So.... yes.
  - Silhouette 10y ago
    That is genuinely disturbing! Do some payment services not do at least a basic check of integrations before allowing them to go live? I haven't worked on a site starting out with online payments very recently, but the last time I did, there was a short series of entries in the server logs that did look like someone from the payment service had taken at least a very quick look at the relevant pages.
enobrev 10y ago
We shouldn't be asking this of clients any more. Build the site with SSL on all pages and either require the client buys a cert or implement Let's Encrypt. But at this stage, it makes no sense to make it optional, even for non-commerce sites.

4 ms·

You know it. I know it. Most of HN knows it. We are, in general, not the customer. On sites I've been involved with, in 2016, I still have to fight tooth and n

by technion 10y ago

Silhouette 10y ago
On sites I've been involved with, in 2016, I still have to fight tooth and nail to get SSL on the payment page at all I'm reasonably sure that every payment service I've ever used requires payment pages to be served over HTTPS, not just HTTP, even those that have minimal other requirements and take on most of the security burden themselves with some sort of hosted arrangement. Are there really significant numbers of merchants who aren't doing that?
- technion 10y ago
  As a low tech experiment, I just grabbed the list that started this thread and tried a few random sites. I only made it to the third one before I found an http:// http:// checkout page. I tried to change the address to https:// https:// and found it complaining about a cert mismatch. I also viewed source and confirmed the form submits to an http:// http:// address. So.... yes.
  - Silhouette 10y ago
    That is genuinely disturbing! Do some payment services not do at least a basic check of integrations before allowing them to go live? I haven't worked on a site starting out with online payments very recently, but the last time I did, there was a short series of entries in the server logs that did look like someone from the payment service had taken at least a very quick look at the relevant pages.
enobrev 10y ago
We shouldn't be asking this of clients any more. Build the site with SSL on all pages and either require the client buys a cert or implement Let's Encrypt. But at this stage, it makes no sense to make it optional, even for non-commerce sites.