No indication that payment pages are secure

[Stuart Langridge]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

There should be some indication that payment pages in the store are
secure, perhaps with a padlock in the status bar.

 affects rhythmbox-ubuntuone-music-store
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkuGW2oACgkQk9furQwNFBQj2QCeJ1iwuNW3mTpHIDQeCO5y9CVx
78YAnAxNDoI66KvC+uMpvSJLzEwW6JvU
=VSlP
-----END PGP SIGNATURE-----

[Stuart Langridge (sil)]

Assigning to mt for visual design thoughts.

[Mat Tomaszewski (mat.t.)]

Mockup and the icon attached. The position should be fixed, bottom right, on top of any content.

[Matt Griffin (mattgriffin)]

Should show on the Choose Card page and the My Downloads page.

[Matt Griffin (mattgriffin)]

mt - Is the current ssl cert icon sufficient? It doesn't display on the My Downloads page.

[John O'Brien (jdobrien)]

On 03/24/2010 10:42 PM, Matt Griffin wrote:
> mt - Is the current ssl cert icon sufficient? It doesn't display on the
> My Downloads page.
>
>
It doesn't display in rhythmbox when you enter your card information.

[Chris Woollard (cwoollard)]

There should probably be a way to view the ssl certificate as well. Just like you can in a web browser.

e.g. click on the secure icon.

thanks
chris

[Mat Tomaszewski (mat.t.)]

@ Matt Griffin

Are you asking about the padlock icon? I think it is sufficient, but it should appear in the Rhythmbox status bar and, indeed, display the ssl certificate in the new gtk window when clicked.

[Chris Woollard (cwoollard)]

That is exactly what I mean.

Thanks
chris

[Martin Meredith (mez)]

Personally, a padlock icon in rhythmbox wouldn't suffice for me, as that could easily be "faked" ... and, well, we could potentially have a MITM with a cheap SSL certificate (CACert maybe, if that's included).

I'd personally like to see an external page load up in my browser, where I can confirm the details and "register" my card or paypal account (though, whether you're storing the CCs is a different matter! - and a bigger security risk!)

It's a bit of a tough one really... if not storing, maybe an external site that allows you to buy "vouchers" that get linked to your U1 account? And for paypal - a "payment agreement" ?