I have a question around giving credit card information on a non-secure web-site, with a seemingly sub-site that's secure. Is this truly secure? I read on another question answered on the forum to check for the source code and look for "Form Action = ", but there's nothing like that on the source page No HTTPS on credit card entry form - can it be safe?
Here's the website: http://thaigardenoc.com/onlineorder.html
Thank you for your responses!
While the page itself isn't loaded over HTTP, the order display is an Iframe that's loaded over HTTP, but posts to an HTTPS page.
While the form itself posts to an HTTPS page, the loaded frame itself is HTTP.
This is insecure due to the fact that the content of the iframe has no integrity. The page itself could be modified by a MITM to post the form to a rogue service. If you inspect the form, you can see it's sending the payment to "spreedly", which upon searching is a credit card processor.
However, there is a click handler and submit handler for the forms.
These handlers have the ability to hijack that URL, and change it right before it actually posts. Creating another avenue for your card information to be stolen.
The ordering form itself is hosted on another site, http://onlineorders.wawio.com/menu/535fe1caf61e46ae172330d8 however when I try to put https I get an invalid name error, instead identifying itself as a site called "OpenDining". If you accept the error, it'll show you the page you requested.
Don't order through them. If you want to complain to them, go here http://www.wawio.com/es/contact-us
As designed, the form does indeed submit to an HTTPS site. This means if the site works as designed, then your credit card information stays secure.
The problem lies in the fact that since this page is not secure, if you have a malicious man in the middle, such as an untrusted wireless network, this page is not secure from tampering, and could be modified so that your credit card information is not sent over a secure connection, or indeed not sent to the restaurant at all, but to the attacker instead.
The entire order process needs to be protected by TLS. Not just the payment acceptance page.
Do not surrender your credit card or other payment information on a page that is not SSL encrypted, that is, HTTPS. SSL/TLS is end-to-end encryption between your browser and the web server such that no one in the middle can view the sensitive data (credit card number in this case).
It is hard to believe that a business today is asking for payment information over a non-secure HTTP only page. While they say that the payment portion is "secure", it doesn't seem like it and I would order my food at another website. A MiTM attack implemented by someone on your local LAN, using tools such Wireshark, will end up revealing your credit card information in plaintext.
For a better understanding of the issue, check the answer to a similar question here on how to determine if your connection is insecure: No HTTPS on credit card entry form - can it be safe?
