Hacker News Reader

Comment by leftnode | Hacker News Reader

I rather enjoyed the article, but the fact that:

  * The site isn't https by default
  * Going to https://www.blueleaf.com (or non-www) shows an untrusted warning in Firefox

made me weary of signing up. It looks like a beautiful service, but any website handling real money or financial information should be secure by default.

View on HN

HTTPS for the marketing site increases page load times; there's no real reason to force people just browsing by to a secured server. The app itself, of course, is secure; it's just on a different subdomain: https://secure.blueleaf.com/signin

My todo for today (assuming my cold doesn't lay me low) is to write about our approach to security.

Is the page load time that significant in bounce rates? (Your list includes A/B testing; how about figuring out if you get more emails when the marketing page is secure or insecure?)

Why would you insist on a homepage, with no secure information or login form whatsoever, have SSL security on it? Neither Quicken nor Mint do this on THEIR home pages.

I didn't know there was a secure.blueleaf.com subdomain, and I don't use Mint or Quicken.

Financial sites should be secure by default, load times be damned.

But what's insecure about the marketing pages being sent in the clear?

It's common practice to setup a subdomain for your secure communications so that you aren't having to send images, javascript and public pages through HTTPS. Load times are part of the reason, but the other is that it takes more resources on the server end too.

I'd love to hear your actual reasoning on this though.

Because the users go to the marketing page to find the login button. You're still just as vulnerable to MITM.

Not to be a pedant, but that's 'wary' and not 'weary'. :)

Reply on news.ycombinator.com