4 ms·

I rather enjoyed the article, but the fact that: * The site isn't https by default * Going to https://www.blueleaf.com (or non-www) shows an untrusted warn

I rather enjoyed the article, but the fact that: * The site isn't https by default * Going to https://www.blueleaf.com (or non-www) shows an untrusted warning in Firefox made me weary of signing up. It looks like a beautiful service, but any website handling real money or financial information should be secure by default.

gnok 16y ago
Not to be a pedant, but that's 'wary' and not 'weary'. :)
gacba 16y ago
Why would you insist on a homepage, with no secure information or login form whatsoever, have SSL security on it? Neither Quicken nor Mint do this on THEIR home pages.
- leftnode 16y ago
  I didn't know there was a secure.blueleaf.com subdomain, and I don't use Mint or Quicken. Financial sites should be secure by default, load times be damned.
  - tannerburson 16y ago
    But what's insecure about the marketing pages being sent in the clear? It's common practice to setup a subdomain for your secure communications so that you aren't having to send images, javascript and public pages through HTTPS. Load times are part of the reason, but the other is that it takes more resources on the server end too. I'd love to hear your actual reasoning on this though.
    - blasdel 16y ago
      Because the users go to the marketing page to find the login button. You're still just as vulnerable to MITM.
sachinag 16y ago
HTTPS for the marketing site increases page load times; there's no real reason to force people just browsing by to a secured server. The app itself, of course, is secure; it's just on a different subdomain: https://secure.blueleaf.com/signin https://secure.blueleaf.com/signin My todo for today (assuming my cold doesn't lay me low) is to write about our approach to security.
- sorbus 16y ago
  Is the page load time that significant in bounce rates? (Your list includes A/B testing; how about figuring out if you get more emails when the marketing page is secure or insecure?)

gnok 16y ago

Not to be a pedant, but that's 'wary' and not 'weary'. :)

gacba 16y ago

Why would you insist on a homepage, with no secure information or login form whatsoever, have SSL security on it? Neither Quicken nor Mint do this on THEIR home pages.

leftnode 16y ago
I didn't know there was a secure.blueleaf.com subdomain, and I don't use Mint or Quicken. Financial sites should be secure by default, load times be damned.
- tannerburson 16y ago
  But what's insecure about the marketing pages being sent in the clear? It's common practice to setup a subdomain for your secure communications so that you aren't having to send images, javascript and public pages through HTTPS. Load times are part of the reason, but the other is that it takes more resources on the server end too. I'd love to hear your actual reasoning on this though.
  - blasdel 16y ago
    Because the users go to the marketing page to find the login button. You're still just as vulnerable to MITM.

sachinag 16y ago

HTTPS for the marketing site increases page load times; there's no real reason to force people just browsing by to a secured server. The app itself, of course, is secure; it's just on a different subdomain: https://secure.blueleaf.com/signin https://secure.blueleaf.com/signin My todo for today (assuming my cold doesn't lay me low) is to write about our approach to security.

sorbus 16y ago
Is the page load time that significant in bounce rates? (Your list includes A/B testing; how about figuring out if you get more emails when the marketing page is secure or insecure?)