3 ms·
Very good idea however: When you provide an service like this and your website got mixed SSL content (seems like due to youtube video, so mixed only after user
by fmavituna 14y ago
Very good idea however:
When you provide an service like this and your website got mixed SSL content (seems like due to youtube video, so mixed only after user plays the video), it's a bit worrying.
Not to mention this:
"Use our sign in UI, and get secure authentication over https for free. Don't waste another moment buying or implementing ssl certs ($70 on GoDaddy)."
Which is really really bad advice. SSL is not just for authentication. Keeping auth over SSL and rest of the website over HTTP is an insecure way to implement an authentication system.
- nostromo 14y agoYou'll never get a mixed content warning on our site if you don't play the YouTube video. Unfortunately, even if you use YouTube's https embed, it still redirects the browser through a single http site. It's annoying and I don't like it, but neither YouTube or Vimeo offer pure https best I can tell just yet. As for implementing HSTS (as we have on our site) - it's great advice. We understand that a man in the middle attack could rewrite a customer's non HTTP page and send them to a site that looks like Dailycred but is not. (Facebook by and large suffers from the same vulnerability.) But compared to not implementing HTTPS at all, we think Dailycred is a huge step up.