{"id":353,"date":"2007-10-08T23:29:46","date_gmt":"2007-10-08T22:29:46","guid":{"rendered":"http:\/\/www.itwriting.com\/blog\/?p=353"},"modified":"2007-10-08T23:29:46","modified_gmt":"2007-10-08T22:29:46","slug":"paying-on-the-web-look-for-the-small-padlock-not-the-big-one","status":"publish","type":"post","link":"https:\/\/www.itwriting.com\/blog\/353-paying-on-the-web-look-for-the-small-padlock-not-the-big-one.html","title":{"rendered":"Paying on the web? Look for the small padlock, not the big one"},"content":{"rendered":"

A friend drew my attention to a security issue on thetrainline.com<\/a>, a UK website for purchasing train tickets.<\/p>\n

She planned her journey and then entered her credit card details, noting that the browser confirmed that she was on a secure page:<\/p>\n

<\/p>\n

In this case, Internet Explorer shows the url in green, which means it uses an Extended Validation (EV) SSL certificate<\/a>, giving extra confidence that all is well. Indeed, in normal circumstances it would have been.<\/p>\n

Unfortunately she made a small error with the card details. The site then bounced her to an insecure page, inviting her to re-submit her details but this time over HTTP. The image below shows part of the web page, including the credit card details (albeit with whatever errors caused the validation to fail) and the IE property dialog confirming that the page is not encrypted:<\/p>\n

<\/p>\n

Now the comforting green url is gone, replaced by plain black on white:<\/p>\n

<\/p>\n

However, the big padlock graphic is still in place, along with logos for Verified by Vista and MasterCard SecureCode.<\/p>\n

It looks to me as if the card details are sent in plain text twice, first when bounced back to the user for correction, and second when re-submitted.<\/p>\n

The site was advised of the problem 24 hours ago, but I was able to replicate the issue just now. Moral: look for the small padlock in the address bar, not the big reassuring graphic on the page itself.<\/p>\n

Is this a big security risk? As far as I’m aware, the chance of a criminal intercepting internet traffic to look for useful information is slim. That’s just as well, given the number of sites that do bad things like emailing password reminders in plain text. The risk is not just theoretical though; the traffic could be logged or intercepted.<\/p>\n

Let me emphasise: thetrainline.com is a respectable web merchant and I am sure this is no more than a bit of careless coding. After all, there is no advantage to the web site if you send your card details unencrypted. They get them anyway.<\/p>\n

Technorati tags: security<\/a>, thetrainline.com<\/a>, ssl<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

A friend drew my attention to a security issue on thetrainline.com, a UK website for purchasing train tickets. She planned her journey and then entered her credit card details, noting that the browser confirmed that she was on a secure page: In this case, Internet Explorer shows the url in green, which means it uses … Continue reading Paying on the web? Look for the small padlock, not the big one<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[44,75,96],"tags":[],"class_list":["post-353","post","type-post","status-publish","format-standard","hentry","category-internet","category-security","category-web-authoring"],"_links":{"self":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts\/353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/comments?post=353"}],"version-history":[{"count":0,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts\/353\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/media?parent=353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/categories?post=353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/tags?post=353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}