4 ms·
You really should just leave it alone. Unless you have a personal stake in seeing this fixed, there's just way too much "shoot the messenger" going on these day
by noonespecial 16y ago
You really should just leave it alone. Unless you have a personal stake in seeing this fixed, there's just way too much "shoot the messenger" going on these days to do this safely. You don't have to be web-batman. (Not that there's anything wrong with that, if that's your thing. Just remember how often people thought batman was the bad guy.)
You already know that they have very little expertise when it comes to security, are you sure that you can explain to them whats wrong without sounding to them like an evil hacker who broke into their interwebs?
- froo 16y agoWeb-Batman - I like that. The thing is, its not even an issue that's difficult to fix and its not as if I broke anything, the security hole is blatantly obvious. Basically, the offending form doesn't use SSL or any kind of encryption when people send in private information, which does include sensitive financial information amongst other things. Given the level of information they require, anyone intercepting that info could easily social engineer things like passwords out of that person, which is why I'm worried about it. Ah well, at least I tried...
- iuguy 16y agoI'd keep trying to contact them then look at walking away. An SSL-related issue like that is not something you're going to get accused of hacking for reporting. If you're really serious you could contact your local information privacy directorate (in the UK this would be the Information Commissioner's Office - I don't know who it is for the US) and ask them to investigate.