Hacker News Reader

Ouch number 5 in NZ is a Credit card payment gateway

In their defense, they don't offer payments through the site. Their actual payment gateway (sec.paymentexpress.com) is secured with https [1].

I'd be more concerned with the ecommerce sites on the list, like Rebel Sport. Kmart at least does seem to redirect to HTTPS.

[1] http://paymentexpress.com/merchant-ecommerce-pxpay.html

Yes, but if you can midm the http connection you can appear the main site however you like. Including some login format or other way to obtain sensitive data.

...which is completely stupid because they score A+ on SSLlabs [0]. They even have HSTS etc., they really just have to preload it + add a 301 redirect.

[0] https://www.ssllabs.com/ssltest/analyze.html?d=paymentexpres...

Reply on news.ycombinator.com