HTTP and Secure Data Transmission

[Demon10000]

My company decided to send us a little incentive. They purchased a visa gift card for us and sent it out without telling us. After receiving it, you had to activate it. The activation site did not use HTTPS. In fact, if you changed the URL to HTTPS, it would redirect you to an HTTP page.


I thought everything transmitted over HTTP was plain text? I guess client side scripting engines could encrypt the data, but why not use HTTPS on top of that for more security? The activation site asked you for the card number as well as the CVN code, and I definitely didn't feel comfortable sending it in plain text over the internet.

I pretty much buy everything except groceries over the internet and I've never seen a place ask me for a credit card number on an HTTP site before. Is using HTTP to transmit data like credit card information safe? I didn't think it was!!!

It could be a great scam, though. Sell people gift cards. Once they activate it in plain text over the internet, "steal" the value of the gift card back. I'm not saying that this is what the company was doing, it just took me as odd that it wasn't an HTTPS site.

 

[da sponge]

People are stupid, especially when it comes to security. Developers, for the most part, are no different. In most cases they're worse because their ignorance has more far reaching consequences than a single user.

I just dealt with one of our partners (a large CC company) who outsources security training and validation. The site uses HTTPS, however it uses a cert from an untrusted authority - it's untrusted by Firefox's default store, although recent windows updates have included it in microsoft's store. The company didn't see the irony in training people to disregard SSL security warnings for an online security and confidentiality training seminar.

 

[hypno-toad]

Are you sure the page wasn't a mix of some http and some https elements?

 

[Demon10000]

Are you sure the page wasn't a mix of some http and some https elements?

After seeing your response, I took another peek at the site. There are no visual indications in the browser to tell me that it's secure. I took a peek at the source and there are HTTPS references in there, but a normal user wouldn't check that.

Have a peek for yourself.

I found this in the source:

	function activate()
	{
		card_num = document.getElementsByName('C[card_number]')[0].value;
		card_cvn = document.getElementsByName('C[card_cvn]')[0].value;
		phone = document.getElementsByName('C[phone]')[0].value;
		array = new Array(card_num, card_cvn, phone);
		xajax_ajaxCardActivate(array);
	}

Looks like they just grab the plain text fields and pass them to a function? I'm not too familiar with web programming, but I couldn't find that function in the script, so I assume the function stays on the server and it passes the data to it....

I dunno. Just doesn't seem right. You figure they'd want that little lock to appear so people can just glance down and say, yeah -- it's secure, and get that warm fuzzy about typing their credit card number into the internet.