4 ms·

Also, it is just me or is the donation page using HTTP instead of HTTPS? Maybe naive, but that's a showstopper for me.

by gavinpc 12y ago

jws 12y ago
You are right! Hope no one was listening when I made my donation. If you try to use SSL you will find a certificate mismatch with the host as well. Ok. Don't donate, put a reminder in your planner to come back and try to change the world next week.
DEinspanjer 12y ago
Yeah, I was going to donate but stopped as soon as I realized that (Thanks LastPass for warning me before auto-filling). I submitted a comment on their feedback form letting them know, but I'm very surprised that Stripe would be involved and not help them avoid such a significant goof-up.
scottlinux 12y ago
Eek - not naive. This is taking credit card information over HTTP (form submit is over HTTP) all on a Wordpress site via a Wordpress cart plugin.
notme_ 12y ago
http://mayone.us/distribution-plan/ http://mayone.us/distribution-plan/ " What payment processor do you use? Are my money and information safe? We have decided upon using Stripe as our payment processor. Stripe has offered us a very competitive rate (for which we thank them), and Stripe is compliant with PCI requirements and no sensitive data hits our servers. When you enter in your credit card information, it is not stored on the mayone.us site and goes directly to Stripe via the Stripe.js API. Or in short: Yes, your money and info are safe. "
- aetherson 12y ago
  Your money and info are absolutely not safe if they travel over http instead of https. No matter what they do with the data upon receipt.
  - ams6110 12y ago
    The data sent to the Stripe API by the stripe.js code are safe, assuming you got an unmodified stripe.js and that other code was not injected into the page to sniff out the payment data you entered. All in all, your data are probably still safe but this was a definite major OOPS on their part regardless.
    - DEinspanjer 12y ago
      Originally, I was more worried because looking at just the HTML, it seemed that it was doing a straightforward post. They are relying on the stripe.js code to abort the standard form submission and submit via SSL to Stripe's server. What you said still stands though and it is possible for that JS to be circumvented by design or by accident which could cause the information to be sent over an unsecured connection where it could be intercepted.
- sp332 12y ago
  But since the page s served over HTTP, your browser has no way to know if it got the original page (which is probably safe) or if someone modified it in-transit to include malicious code.
justindz 12y ago
Lawrence and crew just responded to my tweet on this. They use Stripe, which is encrypted. The SSL certs for the page that is unencrypted will be up later today. https://twitter.com/Boyko4TX/status/461902353105317891 https://twitter.com/Boyko4TX/status/461902353105317891 EDIT: forgot to link the tweet.
- DEinspanjer 12y ago
  I'm very unhappy with their replies on Twitter. They can't just say that the information is going to Stripe and Stripe is safe. The facts are, they have a form which asks people to put their credit card number in it. That form is on an unprotected page, which means it is vulnerable to some advanced attacks even before posting. Further, the form posts back to the same unprotected page. I don't see any evidence of fancy Javascript behaviors to prevent the posting, but even if it were so, they are still putting their users in significant danger of having that information plucked out of the air by anyone who might be able to sniff the traffic on any leg of the trip from the user's Wifi all the way to the company's firewall.
  - justindz 12y ago
    Agreed. In its current state, I will not participate.
    - DEinspanjer 12y ago
      I'm pushing and anxious because this is exactly the sort of problem that could negatively impact the entire campaign, and I think there is worth to the goal. I hope they take a strong stance and fix it quickly rather than trying to placate and coast to a fix.
  - dllthomas 12y ago
    Did you miss the "SSL certs should go through later today"? I agree "it's going through Stripe" isn't enough, of course.
  - DEinspanjer 12y ago

Also, it is just me or is the donation page using HTTP instead of HTTPS? Maybe naive, but that's a showstopper for me.

by gavinpc 12y ago

Also, it is just me or is the donation page using HTTP instead of HTTPS? Maybe naive, but that's a showstopper for me.

jws 12y ago

You are right! Hope no one was listening when I made my donation. If you try to use SSL you will find a certificate mismatch with the host as well. Ok. Don't donate, put a reminder in your planner to come back and try to change the world next week.

DEinspanjer 12y ago

Yeah, I was going to donate but stopped as soon as I realized that (Thanks LastPass for warning me before auto-filling). I submitted a comment on their feedback form letting them know, but I'm very surprised that Stripe would be involved and not help them avoid such a significant goof-up.

scottlinux 12y ago

Eek - not naive. This is taking credit card information over HTTP (form submit is over HTTP) all on a Wordpress site via a Wordpress cart plugin.

notme_ 12y ago

http://mayone.us/distribution-plan/ http://mayone.us/distribution-plan/ " What payment processor do you use? Are my money and information safe? We have decided upon using Stripe as our payment processor. Stripe has offered us a very competitive rate (for which we thank them), and Stripe is compliant with PCI requirements and no sensitive data hits our servers. When you enter in your credit card information, it is not stored on the mayone.us site and goes directly to Stripe via the Stripe.js API. Or in short: Yes, your money and info are safe. "

aetherson 12y ago
Your money and info are absolutely not safe if they travel over http instead of https. No matter what they do with the data upon receipt.
- ams6110 12y ago
  The data sent to the Stripe API by the stripe.js code are safe, assuming you got an unmodified stripe.js and that other code was not injected into the page to sniff out the payment data you entered. All in all, your data are probably still safe but this was a definite major OOPS on their part regardless.
  - DEinspanjer 12y ago
    Originally, I was more worried because looking at just the HTML, it seemed that it was doing a straightforward post. They are relying on the stripe.js code to abort the standard form submission and submit via SSL to Stripe's server. What you said still stands though and it is possible for that JS to be circumvented by design or by accident which could cause the information to be sent over an unsecured connection where it could be intercepted.
sp332 12y ago
But since the page s served over HTTP, your browser has no way to know if it got the original page (which is probably safe) or if someone modified it in-transit to include malicious code.

justindz 12y ago

Lawrence and crew just responded to my tweet on this. They use Stripe, which is encrypted. The SSL certs for the page that is unencrypted will be up later today. https://twitter.com/Boyko4TX/status/461902353105317891 https://twitter.com/Boyko4TX/status/461902353105317891 EDIT: forgot to link the tweet.

DEinspanjer 12y ago
I'm very unhappy with their replies on Twitter. They can't just say that the information is going to Stripe and Stripe is safe. The facts are, they have a form which asks people to put their credit card number in it. That form is on an unprotected page, which means it is vulnerable to some advanced attacks even before posting. Further, the form posts back to the same unprotected page. I don't see any evidence of fancy Javascript behaviors to prevent the posting, but even if it were so, they are still putting their users in significant danger of having that information plucked out of the air by anyone who might be able to sniff the traffic on any leg of the trip from the user's Wifi all the way to the company's firewall.
- justindz 12y ago
  Agreed. In its current state, I will not participate.
  - DEinspanjer 12y ago
    I'm pushing and anxious because this is exactly the sort of problem that could negatively impact the entire campaign, and I think there is worth to the goal. I hope they take a strong stance and fix it quickly rather than trying to placate and coast to a fix.
- dllthomas 12y ago
  Did you miss the "SSL certs should go through later today"? I agree "it's going through Stripe" isn't enough, of course.
- DEinspanjer 12y ago