But the frame is still encrypted, a hacker is only going to end up with the encrypted frame. The hacker can only manipulate the data around it meaning they can change images, set up fake forms etc but can't access the cc data.
What needs to change though is they need to get rid of that frame and run the whole store in it's own page (which you can already do proved in the link above), then they need to run the images from that store page from a secure source.
It shouldn't take two minutes to fix that and would be simpler and use less bandwidth than running the whole site secured only.
Dear n00binator,
what about a man-in-the-middle attack? What about a complete fake website, attacked by a faked line in "HOSTS"? There are a lot of way to attack a connection.
I am not talking about securing the data on site (Storing, etc...) That is a other chapter. Here we are talking what happend when you use this site (or the faked version).
Your idea is right, to do a rerouting to the site that is in the frame... but that destoyes the corporate design..
)))
I reviewed a payment provider who serves his customers with theyr own corporate design. No Problem...
My point was the sentence from Cry-Tom, that the website is PCI DSS compliant. An my opinion is: It is NOT!
-> See my post (on the first side).
Best regards
L1belle