Too tempting for public access points, caches, proxies, ISPs, malicious software, attackers, and myself to intercept HTTP requests to /tipsy.txt and insert their own payment information. The same goes for payment information extracted from pages.
I’ll submit a patch with the following logic change:
- Only read on-page payment details over HTTPS
- If HTTP page or no on-page payment details, then try to load /tipsy.txt over HTTPS.
This will allow publishers who for technical reasons still stick with HTTP for their main page to still supply payment information for Tipsy over HTTPS.
Browsers will begin marking websites loaded over HTTP as insecure later this year, so this policy is just keeping up with the times.
Too tempting for public access points, caches, proxies, ISPs, malicious software, attackers, and myself to intercept HTTP requests to /tipsy.txt and insert their own payment information. The same goes for payment information extracted from pages.
I’ll submit a patch with the following logic change:
This will allow publishers who for technical reasons still stick with HTTP for their main page to still supply payment information for Tipsy over HTTPS.
Browsers will begin marking websites loaded over HTTP as insecure later this year, so this policy is just keeping up with the times.