[olog-hai]

Another bit of scumminess: When you click to delete a profile, you are taken to a page where you're expected to enter credit card details. Despite the presence of a RapidSSL badge, this page is not encrypted. Even forcing https into the URL doesn't work.

[tzs]

Verified. The credit card submission just does an AJAX transaction, over plain HTTP, to 37.46.127.180. My tcpdump revealed my plain fake credit card details sailing over the wire completely unencrypted.

I've dropped a note to RapidSSL about this.