Plimus transactions not SSL?

[Montrose]

L O gents,

I was about to order WitE but was peturbed by the lack of the famous gold padlock which signifies that my info (credit card details, address etc.) was going between me and the vendor by encrypted SSL.

I'm far from an expert and may be worrying over nothing. However, every financial transaction I can remember doing on the interwebs used SSL. I thought all online transactions should be via encrypted SSL/TLS and not in clear?

[uncc]

there is this on Plimus website under Shoppers FAQ...

I am concerned that your order page is not secure (top)
Our Order Pages are hosted in a very secure environment. However, there are a number of settings your vendor may have selected that cause the ‘padlock’ graphic not to show in your browser. The most common are that either the payment page is nested in a frame (the payment process is secure, but the frameset in which it is displayed may not be); or the vendor uses non-secure graphics, which make the browser think the whole page is insecure.

Please accept our assurances that your transactions are always conducted over secure connections. If you would still prefer to complete the transaction by telephone please select phone order option on the product purchase form, and you will be given the relevant phone number to call.

[Josh]

Yes you're right, I did notice the same thing. Ordered it anyways. [:)]

[Josh]

ORIGINAL: uncc

there is this on Plimus website under Shoppers FAQ...

I am concerned that your order page is not secure (top)
Our Order Pages are hosted in a very secure environment. However, there are a number of settings your vendor may have selected that cause the ‘padlock’ graphic not to show in your browser. The most common are that either the payment page is nested in a frame (the payment process is secure, but the frameset in which it is displayed may not be); or the vendor uses non-secure graphics, which make the browser think the whole page is insecure.

Please accept our assurances that your transactions are always conducted over secure connections. If you would still prefer to complete the transaction by telephone please select phone order option on the product purchase form, and you will be given the relevant phone number to call.

Well I haven't read that part, but I have to tell you... that doesn't reassure me *at all*.
"Please accept our assurances..." Honest? Not reassuring at all.
Haven't had any problem whatsoever paying and d/l the game, and I'm insured against financial risks, but still.... it's a bit weird not seeing that golden lockpad.

[Erik Rutins]

Good question, but no need for concern. The part of the store where you actually enter your order info is on a secure encrypted HTTPS connection and completely secure. Because this is an iFrame within the larger store page, you don't see the secure symbol, but if you right click within the frame and check the info you will see that it is secure. Ordering is completely secure and your data is completely protected at all times.

Regards,

- Erik

[Falkon1313]

I suggest that if you can't get the entire order page (not just iframe) on an https connection, you call attention to that on the actual checkout page where the credit card data is being entered, not just somewhere off in an FAQ.

Maybe something like a big red starburst pointing to the form saying 'Your browser may not indicate that this is a secure page. But this form is in an IFRAME using SSL, if you right-click and view frame info, you will see that it is secure. The rest of the page does not receive your info when you submit the form, it goes straight to the secure IFRAME.'

But really, even if the store site doesn't get the info, SSL certificates are cheap. Adding one would be a cheap and easy way to reassure customers and avoid losing orders.

I had a 'waitaminute' moment when I got to that page, and when I tried to switch it to https://www.matrixgames.com/store and it didn't work, I very nearly decided not to buy. I know the point of the IFRAME is that it's a simple way to make the store look seamlessly branded, but it has the side effect of making it look seamlessly insecure. Not everyone will think of or bother searching the forums to find out the technical details.

[76mm]

Also, as far as I could tell, there was no way I could prevent Plimus from storing my credit card info on their site, which I don't like at all. Every other web vendor I use offers the choice to retain my credit card info or not.

[TulliusDetritus]

Guys, you don't need to give your credit card number on the internets (home of assorted various crooks and clowns).

You might want to use virtual credit cards, which will be empty until you want to buy something... then you transfer the money to this virtual thing, buy what you want to buy and that's it (again empty, until you want to buy something else)... [8D]

[Jeffrey H.]

I had a similar reaction a few months ago. Despite reassurances, I'm not "happy" about it.

[JiminyJickers]

How about not having an iFrame and actually having it a separate secure page.

I want to buy Command Ops but won't be doing it until I can do it securely like on any other website that requires your credit card. So how about actually getting a secure system in place that will ease peoples fears?

[jazman]

http://dilbert.com/strips/comic/1996-01-11/