5 ms·

You should fix the lack of SSL security on thesimpledifference.com Why? iFrame SSL certificates aren't visible, and no, your VeriSign trusted doesn't count. Th

You should fix the lack of SSL security on thesimpledifference.com Why? iFrame SSL certificates aren't visible, and no, your VeriSign trusted doesn't count. This means users will find it offputting as you note. Why else? Someone could hijack the HTTP page and point the iframe location somewhere else where they then intercept bank details. Next knox only seems to support a limited number of banks, unlike ACH which I'm assuming supports alll banks. Finally 'log into their online banking' worries me. I'd never hand over my online banking details to a third party (I suspect doing so would violate the T&Cs on my account!).

tomasien 12y ago
Agreed on the SSL bit - we ask all our businesses to use it but we didn't put it on our test site. That's embarrassing I'm putting it up now. And yes, we serve the 30 banks that constitute 60% of banking volume in the US, and at least 60% of banking customers (although we suspect more, since many people who have a smaller account have a top 30 account too). We're increasing that number, but you can turn our system on so that when we don't integrate, you can still send account number and we do ACH the traditional way. As for you not wanting to login to your online banking - you may be right! You may never do it. However, I've heard that before from a lot of people who turn right around and use Knox 30 seconds later and then become customers - so I hope you're in that group! There are some people who will be cautious, but it's actually smaller % of people than I initially thought it would be.
- napoleond 12y ago
  I don't have a US bank account so this doesn't affect me, but just speaking as "Joe Consumer" you may want to address parent's point about the bank's T&C, since that was the only part of his comment that jumped out at me and the only part you didn't address.
  - tomasien 12y ago
    It doesn't. Thank you for pointing that out. Mint did a lot of the work for us here to be honest, they made it really easy to get this stuff out of the way.
tomasien 12y ago
SSL is fixed on https://thesimpledifference.com https://thesimpledifference.com - don't have htaccess redirecting although I put the rule in. But ssl is up!
- ersii 12y ago
  I would recommend running both https://thesimpledifference.com https://thesimpledifference.com and https://knoxpayments.com https://knoxpayments.com through Qualys excellent SSL Server Test at https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html when you got a spare moment over. I would recommend configuring support for "Forward Secrecy" on both sites and enabling TLS 1.2 on thesimpledifference.com. Current score on both domains is "C".
  - tomasien 12y ago
    Great idea!

tomasien 12y ago

Agreed on the SSL bit - we ask all our businesses to use it but we didn't put it on our test site. That's embarrassing I'm putting it up now. And yes, we serve the 30 banks that constitute 60% of banking volume in the US, and at least 60% of banking customers (although we suspect more, since many people who have a smaller account have a top 30 account too). We're increasing that number, but you can turn our system on so that when we don't integrate, you can still send account number and we do ACH the traditional way. As for you not wanting to login to your online banking - you may be right! You may never do it. However, I've heard that before from a lot of people who turn right around and use Knox 30 seconds later and then become customers - so I hope you're in that group! There are some people who will be cautious, but it's actually smaller % of people than I initially thought it would be.

napoleond 12y ago
I don't have a US bank account so this doesn't affect me, but just speaking as "Joe Consumer" you may want to address parent's point about the bank's T&C, since that was the only part of his comment that jumped out at me and the only part you didn't address.
- tomasien 12y ago
  It doesn't. Thank you for pointing that out. Mint did a lot of the work for us here to be honest, they made it really easy to get this stuff out of the way.

tomasien 12y ago

SSL is fixed on https://thesimpledifference.com https://thesimpledifference.com - don't have htaccess redirecting although I put the rule in. But ssl is up!

ersii 12y ago
I would recommend running both https://thesimpledifference.com https://thesimpledifference.com and https://knoxpayments.com https://knoxpayments.com through Qualys excellent SSL Server Test at https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html when you got a spare moment over. I would recommend configuring support for "Forward Secrecy" on both sites and enabling TLS 1.2 on thesimpledifference.com. Current score on both domains is "C".
- tomasien 12y ago
  Great idea!