Betting site security

[Jute]

Hello. Newbie here with a question about site security and I hope someone can assist please.

I have signed up for PA's trial and been ready to go through the hand-holding since yesterday afternoon. Having been locked out before I began on Corals (but that's been resolved by them) and having signed up with Betfred & Betfair (AND deposited £5 with BF & BF) I'm reluctant to continue because no matter what I do, I cannot get the Corals and Betfred sites to show that they're secure and obviously I don't want to be caught out and have my bank account etc. emptied.

Instead of the green padlock and https etc in the address bar, it's quite specifically telling me that these sites are not secure and that I may be at risk. I've tried putting the http/https before the main address but it's not having it. This is now stopping me from carrying on (and I'm spooked enough already, never having placed a bet before). This is not happening with PA or Betfair (or Moneyshed come to that). Oddly, when I go onto the help page of Corals, it is secure which seem weird.

I have contacted Corals but haven't heard back yet and their livechat wasn't working. I wonder if anyone else is seeing the same as me on the websites.
Be glad of any help or opinions with this.
Thankyou
Jute

 

[Jon]

All the sites are secure, you have nothing to worry about I promise...

 

[Jon]

As an example

Those links / icons at the bottom of bookie websites cover all their privacy / responsible gambling / money stuff

 

[Jute]

OK. Thank you. It did seem a bit weird that such a large and well-used site wouldn't be secure. I'll stop dithering and make a start then!

 

[David Says...]

You're right to be cautious. Being a big and well used site doesn't in itself make it secure.

Frankly, Coral *should* have an secure conenction implementation which shows 'https' in the address bar and a 'secure' padlock. It doesn't, to Coral's shame.

Jon's screenshot shows a statement that Coral/Norton made, but missed off the bottom bit which reminds you of your responsibility to check for a padlock:

https://sealinfo.verisign.com/splas...=www.coral.co.uk&lang=en&lang=20&sid=20&ms=MS

I don't use Coral's desktop site for the same reason as you were concerned. I *do* use its mobile site, as that *is* secure

 

[Jon]

You're right to be cautious. Being a big and well used site doesn't in itself make it secure.

Frankly, Coral *should* have an secure conenction implementation which shows 'https' in the address bar and a 'secure' padlock. It doesn't, to Coral's shame.

Jon's screenshot shows a statement that Coral/Norton made, but missed off the bottom bit which reminds you of your responsibility to check for a padlock:

https://sealinfo.verisign.com/splas...=www.coral.co.uk&lang=en&lang=20&sid=20&ms=MS

I don't use Coral's desktop site for the same reason as you were concerned. I *do* use its mobile site, as that *is* secure

the thing is you can lose the padlock on a page just through linking to an image on your website that isn't https

it doesn't mean your website isn't secure it just means you a simply maybe using an image from a 3rd party site such as imgur or something and bang, there goes ya padlock

Same happens on here if someone embeds an image in a post from an unsecure site - TMS loses its padlock for that one page

 

[David Says...]

the thing is you can lose the padlock on a page just through linking to an image on your website that isn't https

it doesn't mean your website isn't secure it just means you a simply maybe using an image from a 3rd party site such as imgur or something and bang, there goes ya padlock

Tru(ish). Cross-domain mixed content can scupper a padlock.

We're not just talking about the padlock, though. Even if there's some insecure content on here, you'll keep the 'https' part of your URL - it's only the padlock which will disappear.

It's very odd behaviour for Coral to redirect from a secure connection to a non-secure connection, especially given the sensitivity of data transferred.

I suspect it's a mixture of things, not least that Google Chrome is starting to distrust certificates issue by Symantec.

@Jute is right to be cautious and not be blasé about online security - using the mobile site is a sensible precaution.

 

[Jon]

Tru(ish). Cross-domain mixed content can scupper a padlock.

We're not just talking about the padlock, though. Even if there's some insecure content on here, you'll keep the 'https' part of your URL - it's only the padlock which will disappear.

It's very odd behaviour for Coral to redirect from a secure connection to a non-secure connection, especially given the sensitivity of data transferred.

I suspect it's a mixture of things, not least that Google Chrome is starting to distrust certificates issue by Symantec.

@Jute is right to be cautious and not be blasé about online security - using the mobile site is a sensible precaution.

aye I posted the other day about how the July version of Chrome is going to go nuts with warnings on non https websites!!

 

[Jute]

Thank you @David Says... & @Jon . I had noticed the mobile site. I think I'll switch to that for peace of mind.

 

[Jute]

I tweeted them about this and their reply is

Hey Jan, thanks for your message. The site is secure although does not display the padlock. We have an SSL certificate for the site which validates its security. Thanks.