News for hackers. Stuff that matters.

A comment on Why No HTTPS?.

Re:Why No HTTPS? by kuahyeow on Tuesday July 24, 2018 @05:24AM (#17599331)
https://whynohttps.com/country/nz

Ouch number 5 in NZ is a Credit card payment gateway

[ Parent | on HN ]
Re:Why No HTTPS? by toomanybeersies on Tuesday July 24, 2018 @05:35AM (#17599380)
In their defense, they don't offer payments through the site. Their actual payment gateway (sec.paymentexpress.com) is secured with https [1].

I'd be more concerned with the ecommerce sites on the list, like Rebel Sport. Kmart at least does seem to redirect to HTTPS.

[1] http://paymentexpress.com/merchant-ecommerce-pxpay.html

[ Parent | on HN ]
Re:Why No HTTPS? by sebazzz on Tuesday July 24, 2018 @08:36AM (#17600413)
Yes, but if you can midm the http connection you can appear the main site however you like. Including some login format or other way to obtain sensitive data.
[ Parent | on HN ]
Re:Why No HTTPS? by moviuro on Tuesday July 24, 2018 @08:00AM (#17600205)
...which is completely stupid because they score A+ on SSLlabs [0]. They even have HSTS etc., they really just have to preload it + add a 301 redirect.

[0] https://www.ssllabs.com/ssltest/analyze.html?d=paymentexpres...

[ Parent | on HN ]