As a low tech experiment, I just grabbed the list that started this thread and tried a few random sites.
I only made it to the third one before I found an http:// checkout page. I tried to change the address to https:// and found it complaining about a cert mismatch. I also viewed source and confirmed the form submits to an http:// address.
So.... yes.
Re:5900 online stores found skimming
by Silhouette on Saturday October 15, 2016 @08:59AM
(#12713786)
That is genuinely disturbing!
Do some payment services not do at least a basic check of integrations before allowing them to go live? I haven't worked on a site starting out with online payments very recently, but the last time I did, there was a short series of entries in the server logs that did look like someone from the payment service had taken at least a very quick look at the relevant pages.
I'm reasonably sure that every payment service I've ever used requires payment pages to be served over HTTPS, not just HTTP, even those that have minimal other requirements and take on most of the security burden themselves with some sort of hosted arrangement.
Are there really significant numbers of merchants who aren't doing that?