Prompting users to enter payment information over unsecured HTTP...smart.
Looks like it does support HTTPS but there's no redirect & HSTS in place to force use of the secure site which is odd.
Enveloupe: An API for snail mail
41–47 of 47 posts
Re: Enveloupe: An API for snail mail
#42Earlier quoted context omitted.
Yep, although the form posts to a secure URL: https://api.stripe.com/v1/tokens
Doesn't make it better tough, a MITM could change the action URL of the form.
MITM requires a man in the middle. For the most part, a state level adversary is required for a generalized MITM attack.
Re: Enveloupe: An API for snail mail
#43Plenty of printing companies have APIs already (and much lower prices).
Can you list a few?
Re: Enveloupe: An API for snail mail
#44Re: Enveloupe: An API for snail mail
#45Earlier quoted context omitted.
MITM requires a man in the middle. For the most part, a state level adversary is required for a generalized MITM attack.
Come join my wifi network at the coffee shop :-D
Yes, but that's not a general MITM attack as the NSA has pulled off. Only the folks at that particular coffee shop are placed at risk from this particular adversary.
Re: Enveloupe: An API for snail mail
#46Plenty of printing companies have APIs already (and much lower prices).
Can you list a few?
I've using Printing 4 Less. They've got one, and they're not exactly a big fish. I'd imagine most of these would:
http://www.piworld.com/article/the-2015-printing-impressions...
Re: Enveloupe: An API for snail mail
#47Earlier quoted context omitted.
not if it's pinned at the web app level.
Again, MITM. If you mean the front-end web (JS) app, MITM the request from the server to the client browser and replace the hardcoded submission url in the JS.
Not really. I used Play Framework which is also its own webserver. SSL is at both the app and webserver level.