Unsecure web pages

[craigamc]

Hi

 

Does anyone know who to report unsecure websites to

 

for example, a payday loan company collecting credit card details through an unsecure page?

 

thanks

[Conniff]

The info commissioners office takes those sort of complaints.

 

http://www.ico.gov.uk/complaints/handling.aspx

[FelixDaHousecat]

I just checked their site and the credit card info page is 100% secure!

[Conniff]

Checked who's site ??

[FelixDaHousecat]

payday loan

[Conniff]

Ah right, it wasn't a particular company mentioned, just 'a' payday loan company which is the term for all these rip-off loans.

[FelixDaHousecat]

OIC! It's really difficult to complain about unsecure pages when they should be secure. I would try the site host and/or Visa/Mastercard! Which site are you talking about in particular?

[san_d]

Hi

 

Does anyone know who to report unsecure websites to

 

for example, a payday loan company collecting credit card details through an unsecure page?

 

thanks

You could contact the site administrator/webmaster. If it's not already at the bottom of the page you could email webmaster@.

 

You could try to manually hijack the page adding a 's' after "http". If this works you could download and install the "force https" extension for your browser.

 

Sites are not compelled to use https by default, but it would be better if they did. I'm not 100% comfortable using this forum because it doesn't use https but I have no choice.

[Conniff]

This thread is almost a year old so I would think the op has it sorted by now.

[Conniff]

I'm not 100% comfortable using this forum because it doesn't use https but I have no choice.

 

Why, this site doesn't take personal information or debit card details, it has no need to be encrypted.

[san_d]

Why, this site doesn't take personal information or debit card details, it has no need to be encrypted.

I disagree. Login is unencrypted here. Any 12yo can sniff my credentials over the network (and I use wireless most of the time). At least the login process should be over https. Activating https is not a big deal really and the overhead is minimal.

 

Don't forget that most people use the same password for most of their logins. Once you sniff one, you have them all.

 

I don't mind having a self-signed ssl certificate as I don't believe in signed certification.

[Conniff]

Your password is encrypted, even the administrator cannot see your password.

 

As for your wireless, you should have a minimum of WEP protection set up, that's up to the user to do.

[san_d]

Password might be encrypted on your server but end to end transaction is in clear.

 

Wep or the more modern Wap only protect (poorly) the key transaction not the whole end to end credential transaction. And even if it did encrypt traffic, it would do so only within the boundaries of the Wlan.