New Zealand Customs doing payment forms wrong

Forums › Off topic › New Zealand Customs doing payment forms wrong

1 | 2

jarledb

Webhead
3319 posts

Uber Geek
+1 received by user: 1983

Moderator

ID Verified

Trusted

Lifetime subscriber

#1963363 24-Feb-2018 12:04

richms:

I thought browsers would refuse to sumbit to a http url when on a https page without some warning?

Never tried to submit, so never got to see if something happened. Might be able to set up a test to see, won't be trying to pay through the form with an invalid card ;)

Edit: I see that the first part of the process to pay the fees also does the same thing. Never got a warning (other than the greyed out https) in Chrome.

Jarle Dahl Bergersen | Referral Links: Want $50 off when you join Octopus Energy? Use this referral code
Are you happy with what you get from Geekzone? Please consider supporting us by making a donation or subscribing.

jarledb

Webhead
3319 posts

Uber Geek
+1 received by user: 1983

Moderator

ID Verified

Trusted

Lifetime subscriber

#1963365 24-Feb-2018 12:11

jjnz1:

@jarledb how did you find this out? What do we have to look for?

In Chrome the "Secure" mark gets greyed out.

I see now that both the form where you are sending in the invoice number and the resulting payment page are unsecured. Both pages are on SSL, but the form submits to http (no encryption).

The first part (the invoice number) didn't bother me and I thought it could have been an image or something like that making the page show up as unsecured, but when paying and giving out my credit card info I am a lot more alert. So never submitted that form.

In Chrome you can use the inspector to see why a page is showing up that way.

As you can see, Chrome tells me that the form is insecure.

jarledb

Webhead
3319 posts

Uber Geek
+1 received by user: 1983

Moderator

ID Verified

Trusted

Lifetime subscriber

#1963367 24-Feb-2018 12:16

Goosey:

So rather than publise the alledged insecure form, did you think it would have been a better idea to perhaps notify customs via a letter and also include the minister?

Then after such response then publish the result here?

The world will change when you will help it.

Trust me, I sent them an email before writing anything here.

That said, if this was something that could be easily exploited in a targeted manner, I might have been a little more restrictive on publishing it.

This will catch out anyone that are using free or open wi-fi somewhere (its easy to spoof things like airport wi-fi networks and look at the traffic) and paying through this form.

Anyone gathering information at such a place would be able to catch your credit card information. Thats true wether or not they know that NZ Customs have failed in securing their online forms.

I am guessing that it would be rather easy to spoof one of Sparks Wi-fi points in a crowded area and do the same thing. So its quite the problem..

jarledb

Webhead
3319 posts

Uber Geek
+1 received by user: 1983

Moderator

ID Verified

Trusted

Lifetime subscriber

#1963373 24-Feb-2018 12:30

UPDATE: I checked out the payment forms again, and while there are unsecured posts from a form to an http (unsecured) page, this does not seem to include the payment information. So its not the security risk it looked like to begin with, but they really should make sure that everything that goes on in the payment pages are secured.

richms

29104 posts

Uber Geek
+1 received by user: 10222

Trusted

Lifetime subscriber

#1963485 24-Feb-2018 14:55

Some browsers and addons are going crazy with security warnings now popping up all sorts of stuff on http based sites like warnings on login forms not to proceed because its insecure etc. I expect they will get pressured to fix it when people stop using it with the new changes.

Richard rich.ms

1 | 2