17 ms·
The exchange of payment or authentication information is undoubtedly done over TLS so it's probably just not a priority. That said there seems to be some obviou
by brazzledazzle 10y ago
The exchange of payment or authentication information is undoubtedly done over TLS so it's probably just not a priority. That said there seems to be some obvious security issues with it since a bad actor could, as far as I know, inject malicious javascript in the vanilla http page to do all kinds of fun stuff.
- tuxracer 10y agoYeah but the checkout button on the insecure cart page could be changed so that it instead points to http://www.apple-payment.com/.. http://www.apple-payment.com/... or any random malicious "checkout" page which then steals your CC. They've compromised the security of credit card details users will at some point enter by doing this. It's insane if that isn't a priority.
- RKearney 10y agoIt also exposes all of your cookies for apple.com since not a single cookie is marked secure/HTTPS only.