3 ms·

I was sympatehtic of the site owner until I read that they are sending credit card information over HTTP on a page that claims to be doing so securely. With tha

• jacquesm 10y ago
  Still, the chances of that number being caught 'in transit' are a lot smaller than the chances of it being caught 'at rest'. The risk here is mostly in exploits on the page and absent those you're going to have to trust the party on the other end to keep your data safe or to not keep it at all. It's a risk roughly equivalent to speaking on the phone to a hotel registry and giving them your CC#, or a car rental agency. And in that case, at least one other person now has your number (and that's besides all the other people that already have the numbers and those that handled the card in your absence, waiters in restaurants and so on). Credit Cards working without something along the lines of VBV is a bug, not a feature and the fact that 'just a number' is worth money is where the real problem lies, not in how it got transmitted, that's just a reduction of the risk, not an elimination. All that said there is absolutely no excuse why they should not use HTTPS, and it also makes you very wary of doing business with this party at all, likely their other security sucks.