Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Ok, now how about enabling HTTPS for amazon.com?

Off topic, I know, but come on. It's the last major service I use that doesn't even support it.



I thought only browsing was HTTP, but as soon as a customer proceeded to checkout, it switched to HTTPS?


I really have no idea what this comment even means. The entire ordering and sign in pipeline has been https forever. Once you are on https it stays https until you explicitly got to http://, iirc. Lastly theres no content, that im aware of, that is available plaintext and not https.


https://www.amazon.com/ redirects me to http://www.amazon.com/ as does every product page. This is one reason why that's a problem: http://www.thoughtcrime.org/software/sslstrip/


Just tried it. It uses https as soon as you login for me.


Crucially, the login form itself isn't included in the high-volume (http) landing pages, but is isolated behind a (https) link from those pages.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: