(I work at Stripe.) Yeah, we require that people use SSL on the payment pages they serve. ... And yet, despite that, it's not quite a clear-cut situation. Whe

(I work at Stripe.) Yeah, we require that people use SSL on the payment pages they serve. ... And yet, despite that, it's not quite a clear-cut situation. When you enter payment details on a site, checking for HTTPS in the address bar is just a heuristic -- you're (mostly reasonably) assuming that "the payment form is served over HTTPS" implies "payment details will be submitted over HTTPS". Browsers try to help here (with warnings for HTTPS -> HTTP form submission), but a poorly implemented site could easily leak information, and you couldn't tell in advance unless you audited all the HTML and JavaScript. The Stripe Checkout -- which prismviz is using -- always submits details over SSL (of course), but we additionally require websites to serve the enclosing page over SSL because it's both more secure and what users expect. We rolled out some code recently to more effectively prod users that aren't using SSL in production to implement it. This helps a bit, but it'll always be possible for a weekend project to go live without having crossed every t. Either way, people tend to do the right thing here pretty quickly, since -- as this thread shows -- users complain if they don't.