Are there ways to serve a related cert 'by accident' if you don't set up https explicitly for a domain?

Annualmedicalreport is in a related line of work to this site - it's not about medical care but about looking up the information health insurers gather about patients. It has some positive reviews from real news sources, but it also sets off some alarm bells for me. It seems to be eager for your data itself, and has a weird sideline of articles about non-medical consumer reporting that read like sponsored content.

Given all that, I wouldn't be surprised if they were connected to (possibly the creator of) this broker site, and that's why their cert is being served.

None of which actually makes me feel better, and the failure to disclose Analytics certainly isn't encouraging.

I manually added the 's' to the protocol to test and the server sent the only cert it had (if present, this is normal). It's like entering an IP address and having the server return the default site over HTTP.

Many sites ignore the Google Analytics requirement but I think this one should aim a bit higher, especially with all the legal geniuses involved in writing that privacy page.

   Is this a hoax site or are they for real?

Not a hoax. Agreed that we need to update the security certificates. Not an excuse, but we are operating with very limited funding.

   The Policy also includes this gem...

The founder of the site is a lawyer specializing in consumer protection. The privacy policy is required for our protection.

(edit: formatting)

I think the original poster is pointing out the irony that a site that exists to help people opt out of data mining allows itself, through it's privacy policy, to data mine.

EDIT: Also, there exist free SSL certificate providers.

As stated, the privacy policy is to legally protect ourselves because we have attorneys working on the project.

   Also, there exist free SSL certificate providers.

Yeah, we've actually tried open SSL on some other projects. We think it is still lacking in real usability.

Ask your attorneys how you are complying with the notice requirement in Section 7 of Google Analytics Terms of Service. That's what the parent was referring to and those terms would normally apply to your company if it is enrolled in analytics and using it on its site.

Your lawyers are awful then. You don't need permission to collect and merge data about us in order to provide this service- if you're explicit about what you actually do then that's all the privacy you need. On top of that your supposed lawyers, in the process of trying to protect you, have you violating the terms of service of one of your vendors and are violating your own privacy policy but not disclosing that you are using google analytics. So your lawyers appear to be doing the exact opposite of protecting you.

In all seriousness, see if you can get a group like the EFF to help you craft a privacy policy that isn't so ridiculous but still protects you.

> As stated, the privacy policy is to legally protect ourselves because we have attorneys working on the project.

I understand how you need a privacy policy (with or without attorneys working on the project). I don't understand how you need a policy that says you will use personal information for direct and online marketting, for protection. Couldn't you just not do that, and have a policy that says you won't?

Why does having attorneys involved specifically matter?

Oh but they really need those analytics to improve your experience!