1

In the UK our postal service drops cards through our mailbox when there is a fee to pay on a item of mail. On this card it gives us a URL to visit to pay the fee, after following the links you get to this site:

http://www.royalmail.com/portal/rm/esurcharge

Royal mail URL

Page is secure

In the top right corner of the page it says "This page is secure", in fact this link goes to a FAQ which includes the following text:

All details are taken over a secure network and held in compliance with all required UK security and data protection standards. To help keep your details secure, please do not share your password with anyone.

Am I missing something:

  • The site doesn't use HTTPS (SSL).
  • Adding the "s" after http re-directs back to the non-SSL site.
  • There appears to be nothing in either FireFox or IE that indicates it has even made an attempt to use SSL.
  • Starting from royalmail.com and working my way through I still get a non-SSL site.

I don't intend to put my credit card details in there, however I am slightly at a loss as why such a large company would mess up in this way. I can't quite believe it, could this be something else?

EDIT: You can register on the site (which is secure), and enter credit/debit card details which is also secure. However on most of the secure pages the "This page is secure" link is missing... go figure.

5
  • if the paranoia is getting the better of you, you can always "Bring the card to the Delivery Office as stated on the fee to pay card, pay the charge and collect the item. Please remember to bring proof of identity" :)
    – Molly7244
    Dec 17, 2009 at 18:22
  • When you click that link beside the padlock, there is actually nothing about security in the link. Maybe in the process of putting that on all their secured pages they accidentally threw it on there. But that page only asks for your address and other details which isn't really sensitive information.
    – user1931
    Dec 17, 2009 at 18:26
  • 1
    I fully well intend to. I wouldn't call it paranoia, I thought I was going mad trying to figure out how the page is secure. Dec 17, 2009 at 18:27
  • tying to figure out 'how secure is secure' can drive you crackers indeed :) and what good is the most secure website if you happen to catch a keylogger/trojan, giving away the precious details? that's what disposable credit cards are for.
    – Molly7244
    Dec 17, 2009 at 18:41
  • If https is not present throughout the site, and 'secure sections' are not seperated using cross origin request security, all it takes it intercepting a http request on the root/common subdomain to implant some malicious JS code (which could persist in caches or via the service worker).
    – Vix
    Jul 30, 2019 at 11:54

2 Answers 2

3

Well, you typically don't use your credit card details until you log in. The log in process is indeed secure with AES-256 encryption, and I assume anything past that is too.

2
  • It does indeed ask you to register with Royal Mail before it asks for payment, ironically on the secure login/register page there is no "this page is secure link". Dec 17, 2009 at 18:25
  • Yeah that's fairly odd. I'd recommend using the address bar as an indicator if something is secured rather than trusting the pages content. They may have forgot to update it.
    – user1931
    Dec 17, 2009 at 18:28
1

FYI some sites in the past (Yahoo from memory) have used Javascript to encrypt the form details before transmitting them over http. Apparently it increases the load on the server to use https. I don't know if anyone still uses this technique however.

1
  • It would indeed increase the load on the web server to use SSL, as each packet would have to be decrypted. Dec 18, 2009 at 15:56

Not the answer you're looking for? Browse other questions tagged .