Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In the UK our postal service drops cards through our mailbox when there is a fee to pay on a item of mail. On this card it gives us a URL to visit to pay the fee, after following the links you get to this site:

http://www.royalmail.com/portal/rm/esurcharge

Royal mail URL

Page is secure

In the top right corner of the page it says "This page is secure", in fact this link goes to a FAQ which includes the following text:

All details are taken over a secure network and held in compliance with all required UK security and data protection standards. To help keep your details secure, please do not share your password with anyone.

Am I missing something:

  • The site doesn't use HTTPS (SSL).
  • Adding the "s" after http re-directs back to the non-SSL site.
  • There appears to be nothing in either FireFox or IE that indicates it has even made an attempt to use SSL.
  • Starting from royalmail.com and working my way through I still get a non-SSL site.

I don't intend to put my credit card details in there, however I am slightly at a loss as why such a large company would mess up in this way. I can't quite believe it, could this be something else?

EDIT: You can register on the site (which is secure), and enter credit/debit card details which is also secure. However on most of the secure pages the "This page is secure" link is missing... go figure.

share|improve this question

closed as off topic by 8088, Nifle, Ƭᴇcʜιᴇ007, random Oct 26 '11 at 23:14

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
if the paranoia is getting the better of you, you can always "Bring the card to the Delivery Office as stated on the fee to pay card, pay the charge and collect the item. Please remember to bring proof of identity" :) –  Molly7244 Dec 17 '09 at 18:22
    
When you click that link beside the padlock, there is actually nothing about security in the link. Maybe in the process of putting that on all their secured pages they accidentally threw it on there. But that page only asks for your address and other details which isn't really sensitive information. –  John T Dec 17 '09 at 18:26
1  
I fully well intend to. I wouldn't call it paranoia, I thought I was going mad trying to figure out how the page is secure. –  Richard Slater Dec 17 '09 at 18:27
    
tying to figure out 'how secure is secure' can drive you crackers indeed :) and what good is the most secure website if you happen to catch a keylogger/trojan, giving away the precious details? that's what disposable credit cards are for. –  Molly7244 Dec 17 '09 at 18:41

2 Answers 2

up vote 3 down vote accepted

Well, you typically don't use your credit card details until you log in. The log in process is indeed secure with AES-256 encryption, and I assume anything past that is too.

share|improve this answer
    
It does indeed ask you to register with Royal Mail before it asks for payment, ironically on the secure login/register page there is no "this page is secure link". –  Richard Slater Dec 17 '09 at 18:25
    
Yeah that's fairly odd. I'd recommend using the address bar as an indicator if something is secured rather than trusting the pages content. They may have forgot to update it. –  John T Dec 17 '09 at 18:28

FYI some sites in the past (Yahoo from memory) have used Javascript to encrypt the form details before transmitting them over http. Apparently it increases the load on the server to use https. I don't know if anyone still uses this technique however.

share|improve this answer
    
It would indeed increase the load on the web server to use SSL, as each packet would have to be decrypted. –  Richard Slater Dec 18 '09 at 15:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.