Hacker News Reader

I thought only browsing was HTTP, but as soon as a customer proceeded to checkout, it switched to HTTPS?

I really have no idea what this comment even means. The entire ordering and sign in pipeline has been https forever. Once you are on https it stays https until you explicitly got to http://, iirc. Lastly theres no content, that im aware of, that is available plaintext and not https.

https://www.amazon.com/ redirects me to http://www.amazon.com/ as does every product page. This is one reason why that's a problem: http://www.thoughtcrime.org/software/sslstrip/

Just tried it. It uses https as soon as you login for me.

Crucially, the login form itself isn't included in the high-volume (http) landing pages, but is isolated behind a (https) link from those pages.