61–70 of 81 posts
Has anyone realized all of this has to do with clkbank.com NOT ClickBank.com Looks like a fake site all together...
This certainly is Clickbank.com
Has anyone realized all of this has to do with clkbank.com NOT ClickBank.com Looks like a fake site all together...
Earlier quoted context omitted.
There's no payment card information besides what's acceptable to show (last four and card type). Full name and email address is PII, but not necessarily in breech of PCI. I don't believe SOX has anything specifically mentioning full name and email PII either. If that's the case, the only thing that would make it a PCI or SOX violation is if the company says in their data privacy policy that they will protect this PII…
Looks like some of these are showing a customer's physical address too. I sure hope that wouldn't be PCI compliant. https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF... (Click on View Details under Tracking Number)
Earlier quoted context omitted.
Cardholders name is PCI data. So in most cases the customer?s name and the cardholders name would fall under the auspices of PCIDSS. This is definitely a breach.
Correct. From the DSS, 'Cardholder data includes: Primary Account Number (PAN), Cardholder Name, Expiration Date, Service Code'
If it were correct, and the card holder name needed to be secure, the company I worked at would not have received level 1 PCI compliance. The solution sends back the truncated card number, expiry date and the full card holder name.
Of course I'm assuming the banks wouldn't want you to make that data public, but you are allowed to store it without needing to be PCI compliant.
CVV code is another matter, under no circumstances are you allowed to store it, unless you're a level 1 compliant payment processor.
Hi, this is Matt Hulett the CEO of ClickBank. ClickBank was recently made aware of a situation in which customers were posting their information using social bookmarking sites, which are indexed by Google. As a result, ClickBank is taking steps to limit the information that a consumer can inadvertently share through such services. We take customer privacy very seriously and believe that all individuals share responsi…
You (CLICKBANK) posted this information online--not your customers. Are you seriously trying to blame them for the fact that your development team seems to have no concern for security and privacy?
Hi, this is Matt Hulett the CEO of ClickBank. ClickBank was recently made aware of a situation in which customers were posting their information using social bookmarking sites, which are indexed by Google. As a result, ClickBank is taking steps to limit the information that a consumer can inadvertently share through such services. We take customer privacy very seriously and believe that all individuals share responsi…
The founder sure knows about technology: "As a research scientist for the NSA, Dr. Tim Barber was..."
Earlier quoted context omitted.
Did you get the job?
No. It was a week long, paid interview. After a couple of days I decided not to come back. Mainly because the main project seemed illegal (which I'll admit held some criminal mastermind allure) and I had another job lined up in Japan. In retrospect, I wish I would have done it as the job in Japan was terrible and I've not come across a similar opportunity since.
Earlier quoted context omitted.
No. It was a week long, paid interview. After a couple of days I decided not to come back. Mainly because the main project seemed illegal (which I'll admit held some criminal mastermind allure) and I had another job lined up in Japan. In retrospect, I wish I would have done it as the job in Japan was terrible and I've not come across a similar opportunity since.
Contact them again?
Does Google pull links from Gmail and attempt to index them? I am wondering how they knew to index these pages with random URLs (the "security through obscurity" employed by ClickBank and defended in the support ticket referenced in the comments here).
I'm fairly certain they do, from experiences in the past where otherwise completely private (but unprotected) URLs have ended up indexed.