2 ms·
On sites I've been involved with, in 2016, I still have to fight tooth and nail to get SSL on the payment page at all I'm reasonably sure that every payment se
by Silhouette 10y ago
On sites I've been involved with, in 2016, I still have to fight tooth and nail to get SSL on the payment page at all
I'm reasonably sure that every payment service I've ever used requires payment pages to be served over HTTPS, not just HTTP, even those that have minimal other requirements and take on most of the security burden themselves with some sort of hosted arrangement.
Are there really significant numbers of merchants who aren't doing that?
- technion 10y agoAs a low tech experiment, I just grabbed the list that started this thread and tried a few random sites. I only made it to the third one before I found an http:// http:// checkout page. I tried to change the address to https:// https:// and found it complaining about a cert mismatch. I also viewed source and confirmed the form submits to an http:// http:// address. So.... yes.
- Silhouette 10y agoThat is genuinely disturbing! Do some payment services not do at least a basic check of integrations before allowing them to go live? I haven't worked on a site starting out with online payments very recently, but the last time I did, there was a short series of entries in the server logs that did look like someone from the payment service had taken at least a very quick look at the relevant pages.