Firefox gets complaint for labeling unencrypted login page insecure

It's marked as a dupe (and presumably flagged) despite the original story now linking to a locked Bugzilla entry, with no information about context.

Could we un-dupe it?

Additionally, as pointed out in this article, the original linked article is now locked:

> You are not authorized to access bug 1348902. To see this bug, you must first log in to an account with the appropriate permissions.

It's got other issues as well. It spewed an error page for me with snippets of source code. http://imgur.com/a/UiPDf

Still, the chances of that number being caught 'in transit' are a lot smaller than the chances of it being caught 'at rest'. The risk here is mostly in exploits on the page and absent those you're going to have to trust the party on the other end to keep your data safe or to not keep it at all.

It's a risk roughly equivalent to speaking on the phone to a hotel registry and giving them your CC#, or a car rental agency. And in that case, at least one other person now has your number (and that's besides all the other people that already have the numbers and those that handled the card in your absence, waiters in restaurants and so on).

Credit Cards working without something along the lines of VBV is a bug, not a feature and the fact that 'just a number' is worth money is where the real problem lies, not in how it got transmitted, that's just a reduction of the risk, not an elimination.

All that said there is absolutely no excuse why they should not use HTTPS, and it also makes you very wary of doing business with this party at all, likely their other security sucks.

Couldn't you just set up a Private CA since you'd have to customize things anyways?