Is this site secure? SSL claimed...

[nuclearfly]

Hey guys, need some help.

http://www.wpskibroker.com is under the microscope.

In their Privacy statement:

Winter Park Ski Broker secures your personal information from unauthorized access, use or disclosure. Winter Park Ski Broker secures the personally identifiable information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use or disclosure. When personal information (such as a credit card number) is transmitted to other Web sites, it is protected through the use of encryption, such as the Secure Socket Layer (SSL) protocol.

When you create a reservation online, and go to confirm it, your payment is due. This page, however, does not show itself as being secure, and does not have a "https:" prefix to the address, despite fields to enter your CC info.

Although, their one saving grace might be the fact that the pay link is a JavaScript method.:

javascript:__doPostBack('dnn$ctr366$ShowPay2$cmdPayment','')

Also, it looks like the site is done mostly in ASP.

Am I just super paranoid? Is this site safe to enter CC info into?

 

[Xenarchy]

i'd throw https in front of the url before I entered any credit card numbers. See if it loads the same page.

 

[nuclearfly]

Well, I put an s in the url of the page itself where the CC fields are:

The resource cannot be found.
Description: HTTP 404. The resource you are looking for (or one of its dependencies) could have been removed, had its name changed, or is temporarily unavailable. Please review the following URL and make sure that it is spelled correctly.

Requested URL: /HOME/SkiReservations/tabid/53/ctl/ShowPay2/mid/366/GroupID/1234/Default.aspx

and their homepage with an s in the url:

This web site has just been created and it is still under construction.
The web site is hosted by HostingCompany Web Hosting Provider.

Yep... won't be entering my CC most likely.

 

[Xenarchy]

Yeah it doesn't sound too secure. I don't enter any super sensitive information such as my CC number w/o having a valid certificate from a CA i trust.