What exactly is Clickbank? It looks like a platform to help people resell their knowledge?
Affiliate marketing scumware. Like how to Make $5000/month at home crap. (Spolier Alert: Sell pamplets on Clickbank)
Clickbank order details in plain view
31–40 of 81 posts
Re: Clickbank order details in plain view
#32Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe... Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the a…
There's no payment card information besides what's acceptable to show (last four and card type). Full name and email address is PII, but not necessarily in breech of PCI. I don't believe SOX has anything specifically mentioning full name and email PII either. If that's the case, the only thing that would make it a PCI or SOX violation is if the company says in their data privacy policy that they will protect this PII…
Cardholders name is PCI data. So in most cases the customer?s name and the cardholders name would fall under the auspices of PCIDSS. This is definitely a breach.
Re: Clickbank order details in plain view
#33Earlier quoted context omitted.
First relevant result refers to the fact that customer's info is available for public viewing. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...
And this customer support ticket shows a customer complaining about the fact that their order information is visible on the internet. This was back in 2011. ClickBank has to have known about this hole for years and hasn't addressed it. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...
Can only hazard a guess that this must be some bizarre form of SEO or something, because this is a known issue that could be fixed in probably 30 minutes max, which they have received complaints for...
Re: Clickbank order details in plain view
#34Does Google pull links from Gmail and attempt to index them?
I am wondering how they knew to index these pages with random URLs (the "security through obscurity" employed by ClickBank and defended in the support ticket referenced in the comments here).
Re: Clickbank order details in plain view
#35Clickbank is a joke! I remember year ago you could put in Google product name and "thank you" and you would find thank you page with direct download link.
EDIT: Someone even made CB product to protect thank you page: Fix My Thank You Page http://fixmythankyoupage.com/ only $97 LOL!
Re: Clickbank order details in plain view
#36What exactly is Clickbank? It looks like a platform to help people resell their knowledge?
Apart from various ebooks and what not, it seems they also help people sell:
Backup software subscription: https://www.clkbank.com/orderDetail.htm?rcpt=4fb75aa1LPBHFEH...
and ...
Phone lookups (they work?): https://www.clkbank.com/orderDetail.htm?rcpt=514323c6WDJ2F3C...
Re: Clickbank order details in plain view
#37Does Google pull links from Gmail and attempt to index them? I am wondering how they knew to index these pages with random URLs (the "security through obscurity" employed by ClickBank and defended in the support ticket referenced in the comments here).
I'm fairly certain they do, from experiences in the past where otherwise completely private (but unprotected) URLs have ended up indexed.
Re: Clickbank order details in plain view
#38Heh, Power4Home System ordered by "I.hate.niggers@microsoft.com" ...
https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF...
Re: Clickbank order details in plain view
#39[deleted]
Re: Clickbank order details in plain view
#40Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe... Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the a…
There's no payment card information besides what's acceptable to show (last four and card type). Full name and email address is PII, but not necessarily in breech of PCI. I don't believe SOX has anything specifically mentioning full name and email PII either. If that's the case, the only thing that would make it a PCI or SOX violation is if the company says in their data privacy policy that they will protect this PII…
Looks like some of these are showing a customer's physical address too. I sure hope that wouldn't be PCI compliant.
https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF... (Click on View Details under Tracking Number)