Clickbank order details in plain view • Hacker News Board

Re: Clickbank order details in plain view

#21

Post by Lutinger » Wed, Jun 19, 2013, 9:06 PM UTC

frogpelt wrote: post #14

Percein wrote: post #10

Earlier quoted context omitted.

It looks like their customer service ticketing system is wide open too: http://www.google.com/search?q=www.clkbank.com/viewTicket.ht...

First relevant result refers to the fact that customer's info is available for public viewing. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...

And this customer support ticket shows a customer complaining about the fact that their order information is visible on the internet. This was back in 2011.

ClickBank has to have known about this hole for years and hasn't addressed it.

https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...

Re: Clickbank order details in plain view

#22

Post by rk0567 » Wed, Jun 19, 2013, 9:06 PM UTC

this is horrible! I can even download ebooks (probably there is "Download Now" button for digital products) from certain orders :(

Re: Clickbank order details in plain view

#23

Post by rk0567 » Wed, Jun 19, 2013, 9:12 PM UTC

hbbio wrote: post #18

aroch wrote: post #2

Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe... Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the a…

You can also (re)download the super expensive scammy ebooks. And there is a bit more details in the URL (ZIP code): http://hypnosiscertified.com/nlp/july152010.php?item=18&cbre...

True, I did one - "Mastering the skill of Blah Blah.."

Re: Clickbank order details in plain view

#24

Post by codegeek » Wed, Jun 19, 2013, 9:13 PM UTC

Hope no one is clicking on the "Resend Receipt Email" button. Imagine a customer receiving the receipt email for something they bought 3 years ago..

Re: Clickbank order details in plain view

#25

Post by hbbio » Wed, Jun 19, 2013, 9:15 PM UTC

rk0567 wrote: post #23

hbbio wrote: post #18

Earlier quoted context omitted.

You can also (re)download the super expensive scammy ebooks. And there is a bit more details in the URL (ZIP code): http://hypnosiscertified.com/nlp/july152010.php?item=18&cbre...

True, I did one - "Mastering the skill of Blah Blah.."

Does not beat "How to pull your ex (Female version)"

Re: Clickbank order details in plain view

#26

Post by swang » Wed, Jun 19, 2013, 9:19 PM UTC

freehunter wrote: post #6

I hate LMGTFY. It's slow and condescending, especially for something like this where slow and condescending don't add anything. Is it not possible to just submit a Google search link? Or use a text-only post?

Looks like a mod has changed it.

Re: Clickbank order details in plain view

#27

Post by swang » Wed, Jun 19, 2013, 9:20 PM UTC

What exactly is Clickbank? It looks like a platform to help people resell their knowledge?

Re: Clickbank order details in plain view

#28

Post by sizimon » Wed, Jun 19, 2013, 9:24 PM UTC

frogpelt wrote: post #14

Percein wrote: post #10

Earlier quoted context omitted.

It looks like their customer service ticketing system is wide open too: http://www.google.com/search?q=www.clkbank.com/viewTicket.ht...

First relevant result refers to the fact that customer's info is available for public viewing. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...

"ClickBank.com is a secure site. The only way someone would be able to look up your order, which does not show any payment detail except your Credit Card type and last 4 digits on the card, is to know the exact order number and email address."

Strange, because the link in the ticket to the order still works and is viewable without any of that information.

Re: Clickbank order details in plain view

#29

Post by rhizome » Wed, Jun 19, 2013, 9:24 PM UTC

swang wrote: post #27

What exactly is Clickbank? It looks like a platform to help people resell their knowledge?

That's a charitable interpretation, but sure.

Re: Clickbank order details in plain view

#30

Post by rhizome » Wed, Jun 19, 2013, 9:26 PM UTC

joshstrange wrote: post #3

And you can edit the email address without being logged in

Since the vaunted FAA Sec 702 orders are being used for cybersecurity as well as (if not more than) terrorism, look for the FBI at your door with CFAA charges soon.