What does the message mean and is it not safe to pay online at this website?

Question

The issue occurs on Opera 45.0.2552.812 Stable Linux 64-bit with browser identification

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 OPR/45.0.2552.812

A web shop (will not tell the name so as not to compromise them in case this is an issue on my side) has a field for entering credit card information (name, expiration date, cvc). When I click any of the fields, Opera displays a combobox-style dropwdown below the field reading "Payment not secure!". At the same time I see a "Content blocked" message in the right end of the address bar. When I click that message and choose to enable said insecure content, I can see that the page is not HTTPS, and clicking the globe in the left part of the address bar, the attached popup is displayed.

What does the information mean and should I refrain from making a payment on that website?

Attached screenshot: https://ibin.co/3QBcZNR12iG3.png

---

Edit:

The "Payment not secure!" warning appears only after I enable the insecure content in the address bar. Until I do it, thee is no warning whatsoever when entering information into the credit card fields.

Answer 1

It's hard to offer anything other than "theories" without analyzing the actual code, but this appears likely:

1. It is a page delivered over https.
2. Some of it loads over http. Something with href= "http://..."
3. This is enough for Opera to a) block the content +and+ show "content blocked" message.
4. As long as the http content is blocked, the rest of the rendered page is safe - hence you don't see an "insecure content" warning. BTW, most browsers do render (without blocking, but with/without warning) what they consider "passive content" despite being http (e.g. images).
5. When you enable the insecure content, then Opera goes ballistic and gives out "insecure content" warnings.

What could go wrong: Some of the active insecure content on the page has access to the DOM - i.e., every bit of information you entered - including your credit card details. This is bad news because unless you dig deeper, you won't know whether that access is abused. So in general, you assume the worst (even if it is just a dumb oversight by a programmer) and don't risk your info. Of course, if you feel confident about your analytical skills, you could analyze the insecure content - make sure it isn't loading more code at runtime and then decide whether its safe. For most peeps, that's a bit too much when all they want is to buy some fidget spinners. :)

P.S. What I can't reconcile here is your "I can see that the page is not https". That doesn't reconcile with the screenshot too (where you do see a cert), so I'm guessing that you meant that the page is not "100% https".

Answer 2

It looks as if the main page is delivered over https but that some of the content isnt. Technically it is not secure, which is why your browser is warning you.

In practice, who knows. If it was a forum site or something else low value I might just do it. No chance with credit card info

Answer 3

What does the information mean and should I refrain from making a payment on that website?

1. Webshop payment entry page without SSL is suspicious

2. Webshop not using proper SSL certificate (self-signed, expired, etc) is suspicious.

3. Webshop that not implement SSL properly means the webshop is poorly maintained, application is unpatched. They are susceptible to cross-site-scripting that perform data skimming.