So I use the Three network in the UK to access the Internet on my phone. Recently, I noticed when going to mobile.three.co.uk to access services which also includes information about my email address, home address, my PIN for accessing security settings, etc. (i.e. my personal and security information), that the website was not encrypted! This meant all my personal information and sensitive PIN number and other security information was being transmitted over the internet in the clear, which is very, very bad for security!
Am I overreacting or is this actually not very good security practice?
You can see screenshots I took:
Now, on that page in the picture above, I have to enter an access PIN, after which I can access pages displaying my home address, email address, international settings, security questions, etc. - but this page itself also uses HTTP not HTTPS! (However, any page to do with financial stuff like direct debit details is encrypted and shows up as HTTPS, but surely pages with personal information should also be encrypted?)