>I am trying to explain to him why this is bad, but he doesn't really care.
"You are losing sales. People look for the lock icon on the address bar."
Also, he can get SSL on his site for FREE in < 5 minutes using Cloudflare.
"You are losing sales. People look for the lock icon on the address bar."
Also, he can get SSL on his site for FREE in < 5 minutes using Cloudflare.
Also, for a totally non-technical person, it will take – and be billed as – more than 5 minutes of someone else's time to get even that free half-measure into effect.
That raises an interesting question: how could a person determine if the connection between an edge (say, Cloudflare) and the destination server is actually encrypted? I can't think of a way to do this unless you know the address of the true IP of the destination and poke it on the SSL port. That still doesn't guarantee SSL is being used, though.
In my opinion best practice would be to obscure what the "true IP" of the backend server is, and only accept connections from Cloudflare. (I don't know if Cloudflare offers any options for this stronger than trusting their IP ranges, such as a client certificate on their outbound-SSL.) So if you could "poke [the true origin] on the SSL port", that could itself be evidence of suboptimal security.
This is what I was planning to do when I launch the app I'm working on now. Thanks for the reply.