Non encrypted shopping?

[eveshopper]

I was about to buy something online and noticed that there was no secure lock icon displayed. The page uses the https protocol, and "store.yahoo.net" is in the url. They claim in their help section that its secure, however my browser says the the site does not supply identity information and the connection is not encrypted. I did not submit any card information, and contacted them about the issue. Since its the weekend, I probably won't get a response for a couple days.

Maybe someone here can tell me what might be going on with that site (toygroove). It looks like business, but isn't acting like one.

[speed]

It looks like only the payment page uses SSL which is fine, the issue is that they are loading the images from a non-SSL source so you have a partially protected page.

Really all that matters is that the form posts the information to the server over SSL anything else is just fluff to make shoppers feel warm an fuzzy inside.

[eveshopper]

I've set my browser to prompt before submitting non-encrypted form data, just to double check. Thanks.

[wige]

It looks like only the payment page uses SSL which is fine, the issue is that they are loading the images from a non-SSL source so you have a partially protected page.

This is really a Yahoo issue, rather than something that the store in question will be able to deal with. Because the checkout page includes elements of the original site (which does not have an SSL certificate) the page can't be fully authenticated. Different browsers handle this in different ways; IE just pretends the page isn't encrypted at all, Firefox shows an alert over the lock symbol, Chrome shows a warning in place of the lock, etc.

Really all that matters is that the form posts the information to the server over SSL anything else is just fluff to make shoppers feel warm an fuzzy inside.

In practice, it is generally desired that every element on the page be authenticated - otherwise, in theory at least, components being included over HTTP could "leak" secured information such as tracking cookies, allowing an attacker to alter your transaction (session hijacking) or view personally identifiable information as it passes from one site to the other (man in the middle attack).

[Clint1]

I was about to buy something online and noticed that there was no secure lock icon displayed. The page uses the https protocol, and "store.yahoo.net" is in the url. They claim in their help section that its secure, however my browser says the the site does not supply identity information and the connection is not encrypted. I did not submit any card information, and contacted them about the issue. Since its the weekend, I probably won't get a response for a couple days.

Maybe someone here can tell me what might be going on with that site (toygroove). It looks like business, but isn't acting like one.

It's secure. (In IE) Just right click the page & "Properties" and you'll see something like this:

TLS 1.0, RC4 with 128 bit encryption (High); RSA with 1024 bit exchange

Click the "Details" button and you'll see the certificate.

On FF just click the padlock icon warning and see the details, or right click and "View page info" then "Security".

Like Wige pointed out, sometimes you won't see the padlock icon in IE if there are something like images on the page that are not in a secure path, such as their header: http://www.toygroove.com/images/left01.gif