It does not fill you with confidence when...

.... you place an order for some parts online, and the confirmation email
starts

---8<
A Cusomter Successfully Paid for the following order:

Order Date: Thursday 20th of May 2010 20:23:30
---8<

 

Nice. I bought a bike seat cushion from the US last year (polymer
gell type thingy that is absolutely superb). Their website has an
order section with no https in sight. When you entered your credit
card details [1], item you were ordering, email address and contact
details a javascript:alert box jumped up telling you that the
transaction was secured by 128 bit SSL encryption and you will receive
an email.

What it was actually doing was doing a HTTP POST to a formmail page
that sent an email to the store. With your credit card in plain text
in the email.

I told the guy running the business it was not secured but he was
adamant it was. Presumably he had been told by his web monkey that it
was secure.

[1] Yeah - honest!

The form results were:







Thank You For Filling Out This Form

Below is what you submitted to on Friday, May 21, 2010
at 10:48:31

firstname: a

lastname: c

middle: MI

StreetAddress: b

AdditionalAddress: d

City: d

State: al

ZIP: 12345

EMAIL:

Phone: 1234567890

CCType: AE

CCNumber: 1111111111111111

Expmth: 1

Expyear: 2010

CCV: 123

PROD_PP_57.00_57.00: 1

FABTYPE: Luster

TOTAL: 57.00

SUBMIT: SUBMIT FORM

 

At least this one appeared to go through HSBC, before that infernal
mastercard password arse shite stuff.