Hacker News new | ask | show | jobs
by kuahyeow 2883 days ago
https://whynohttps.com/country/nz

Ouch number 5 in NZ is a Credit card payment gateway
1 comments
toomanybeersies 2883 days ago
In their defense, they don't offer payments through the site. Their actual payment gateway (sec.paymentexpress.com) is secured with https [1].

I'd be more concerned with the ecommerce sites on the list, like Rebel Sport. Kmart at least does seem to redirect to HTTPS.

[1] http://paymentexpress.com/merchant-ecommerce-pxpay.html

link
sebazzz 2883 days ago
Yes, but if you can midm the http connection you can appear the main site however you like. Including some login format or other way to obtain sensitive data.
link
moviuro 2883 days ago
...which is completely stupid because they score A+ on SSLlabs [0]. They even have HSTS etc., they really just have to preload it + add a 301 redirect.

[0] https://www.ssllabs.com/ssltest/analyze.html?d=paymentexpres...

link