3 ms·
You'll never get a mixed content warning on our site if you don't play the YouTube video. Unfortunately, even if you use YouTube's https embed, it still redire
by nostromo 14y ago
You'll never get a mixed content warning on our site if you don't play the YouTube video.
Unfortunately, even if you use YouTube's https embed, it still redirects the browser through a single http site. It's annoying and I don't like it, but neither YouTube or Vimeo offer pure https best I can tell just yet.
As for implementing HSTS (as we have on our site) - it's great advice. We understand that a man in the middle attack could rewrite a customer's non HTTP page and send them to a site that looks like Dailycred but is not. (Facebook by and large suffers from the same vulnerability.) But compared to not implementing HTTPS at all, we think Dailycred is a huge step up.