6 ms·

https://whynohttps.com/country/nz https://whynohttps.com/country/nz Ouch number 5 in NZ is a Credit card payment gateway

• toomanybeersies 8y ago
  In their defense, they don't offer payments through the site. Their actual payment gateway (sec.paymentexpress.com) is secured with https [1]. I'd be more concerned with the ecommerce sites on the list, like Rebel Sport. Kmart at least does seem to redirect to HTTPS. [1] http://paymentexpress.com/merchant-ecommerce-pxpay.html http://paymentexpress.com/merchant-ecommerce-pxpay.html
  • moviuro 8y ago
    ...which is completely stupid because they score A+ on SSLlabs [0]. They even have HSTS etc., they really just have to preload it + add a 301 redirect. [0] https://www.ssllabs.com/ssltest/analyze.html?d=paymentexpress.com https://www.ssllabs.com/ssltest/analyze.html?d=paymentexpres...
  • sebazzz 8y ago
    Yes, but if you can midm the http connection you can appear the main site however you like. Including some login format or other way to obtain sensitive data.