Just embed an iframe for a secure subdomain and use window.postMessage to communicate with it.<p>Edit: never mind, that is apparently also &quot;insecure&quot;, leading me to think they are doing this because they get a kickback from the SSL cert vampires somehow.