Re:Embracing HTTPS
by nitrogen on Friday November 14, 2014 @03:24PM
(#8609287)
That's why "SSL Everywhere" is security theater. To have "security" on pages that don't need to be secure requires weakening security on the pages that do.
Nah, you can still have separate secure domains with EV certs for taking credit cards. That way your customer's browsing habits and product preferences are protected from snooping by their ISP, the page assets are still cached and DDOS protected, and the credit card data is still sent to a separate domain without an intermediary.
The only thing still to worry about is your caching provider sending maliciously modified content that bypasses your secure domain.
Nah, you can still have separate secure domains with EV certs for taking credit cards. That way your customer's browsing habits and product preferences are protected from snooping by their ISP, the page assets are still cached and DDOS protected, and the credit card data is still sent to a separate domain without an intermediary.
The only thing still to worry about is your caching provider sending maliciously modified content that bypasses your secure domain.