11–20 of 81 posts
I hate LMGTFY. It's slow and condescending, especially for something like this where slow and condescending don't add anything. Is it not possible to just submit a Google search link? Or use a text-only post?
"As a research scientist for the NSA, Dr. Tim Barber was..."
Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe... Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the a…
As far as trying to gain a copy of the information in the email, it might be possible if you were willing to put your own email on record as being part of this data breech. It's also possible that the only thing contained in the email is purchase confirmation (aka, what is shown in the printable invoice).
The problem was that some average developer was lazy and do whatever that worked, with no concern about potential security implications.
It looks like their customer service ticketing system is wide open too: http://www.google.com/search?q=www.clkbank.com/viewTicket.ht...
https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...
Earlier quoted context omitted.
It looks like their customer service ticketing system is wide open too: http://www.google.com/search?q=www.clkbank.com/viewTicket.ht...
First relevant result refers to the fact that customer's info is available for public viewing. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...
https://www.clkbank.com/viewTicket.htm?key=01.71E027164BE509...
Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe... Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the a…
And there is a bit more details in the URL (ZIP code): http://hypnosiscertified.com/nlp/july152010.php?item=18&cbre...
The problem was that some average developer was lazy and do whatever that worked, with no concern about potential security implications.