Ted Cruz’s website poses unnecessary security risks for donors

It's one of the most fundamental rules of online security: if you're asking for sensitive information such as a credit card number, you should use a technology called SSL, or Secure Sockets Layer. This type of encryption is built into all modern web browsers, and it prevents people who are eavesdropping on your communications from snatching your sensitive data.

This morning, Sen. Ted Cruz (R-TX) announced his presidential campaign, and he launched a website that solicits campaign donations. But it doesn't show the little icon that indicates SSL is enabled:

On SSL-protected websites, there should be a padlock icon in the address bar, like this:

As it turns out, the website does use SSL when users actually submit their credit card information. But there are two big problems with the way this is implemented. One is that the lack of SSL protection for the donation page as a whole means that the user is vulnerable to a "man in the middle" attack, where someone impersonates the Cruz website and directs the user to a malicious site instead.

Second, there's no way for ordinary users to know if their credit card details are encrypted or not. For more than a decade, users have been trained to look for that lock icon before submitting personal information. The way Cruz built his website encourages users to do something dangerous: submit personal credit card information without knowing if it's secure or not. If this practice became widespread, users will be more vulnerable because they'll never know if their information is secure or not.

It turns out that the Ted Cruz for president site does offer SSL protection if you navigate to it directly by adding an "https://" in front of the address. However, when I go there with Chrome, I get the not-very-reassuring message that "this page includes other resources which are not secure," meaning that some parts of the webpage are encrypted and others are not. And then there's this:

This is the SSL certificate for tedcruz.org, the digitally signed document that's supposed to prove you're really visiting tedcruz.org rather than an imposter site trying to steal your credit card number. SSL certificates sometimes list alternative addresses for the same website. For example, if Cruz also owned tedcruz.com, the SSL certificate could list that as an alternative domain.

For some reason, the SSL certificate for tedcruz.org lists nigerian-prince.com as another valid address for Cruz's website. (Update: the Cruz campaign appears to have removed nigerian-prince.com from the certificate around 11am.)

Thanks to Twitter user Pwn All the Things for pointing this out.

A Ted Cruz campaign spokesman responded in an email statement: "The donate form embedded on TedCruz.org has SSL. All donations are and have always been secure. Our website earns an A-grade for its SSL."

Correction: This article originally stated that the site doesn't use SSL encryption at all. In fact, the submission of the credit card data is encrypted, but the lack of encryption for the donation page as a whole creates unnecessary risks for user security, as explained above.

Will you support Vox’s explanatory journalism?

Most news outlets make their money through advertising or subscriptions. But when it comes to what we’re trying to do at Vox, there are a couple of big issues with relying on ads and subscriptions to keep the lights on:

First, advertising dollars go up and down with the economy. We often only know a few months out what our advertising revenue will be, which makes it hard to plan ahead.

Second, we’re not in the subscriptions business. Vox is here to help everyone understand the complex issues shaping the world — not just the people who can afford to pay for a subscription. We believe that’s an important part of building a more equal society. And we can’t do that if we have a paywall.

So even though advertising is still our biggest source of revenue, we also seek grants and reader support. (And no matter how our work is funded, we have strict guidelines on editorial independence.)

If you also believe that everyone deserves access to trusted high-quality information, will you make a gift to Vox today? Any amount helps.

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via