News for hackers. Stuff that matters.

A comment on Ask HN: Those making $1,000+/month on side projects - what did you make?. Parent comment

Re:Ask HN: Those making $1,000+/month on side projects - wha... by sync on Tuesday December 10, 2013 @07:08PM (#6884872)
Technically, no. The payment happens within an iframe secured with https: https://www.simplegoods.co/embed/PKGTEISN
[ Parent | on HN ]
Re:Ask HN: Those making $1,000+/month on side projects - wha... by DaCapoo on Tuesday December 10, 2013 @07:25PM (#6884980)
The issue with it however is that the initial page is delivered over an insecure connection, which allows any part of it to be modified in the usual MITM style. Nothing prevents an attacker from changing the link that is served to the client with something else that looks like that payment system and functions the same, but logs the payment information. There's a reason Firefox now disallows mixed HTTP/HTTPS content by default[0]

[0] - https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...

[ Parent | on HN ]
Re:Ask HN: Those making $1,000+/month on side projects - wha... by throwaway125 on Tuesday December 10, 2013 @07:41PM (#6885075)
In other words: yes, it's vulnerable to SSL stripping.
[ Parent | on HN ]
Re:Ask HN: Those making $1,000+/month on side projects - wha... by jafaku on Tuesday December 10, 2013 @09:02PM (#6885408)
If the main page is insecure, then everything is insecure.
[ Parent | on HN ]