3 ms·
Sounds like you've certainly made an effort to contact them. My only other suggestion would be to contact their hosting company's support department and let th
by thinkalone 16y ago
Sounds like you've certainly made an effort to contact them. My only other suggestion would be to contact their hosting company's support department and let them know there is a security issue with one of their clients' sites and you haven't been able to reach the site's owners.
- froo 16y agoSomeone posted a great link to an article at the consumerist. I've managed to guess their email naming convention using a google search, so have sent off a detailed email of the problem to their executives trying to "dumb it down" as much as possible by including screenshots and a basic outline of a social engineering strategy (including a nightmare outcome) that might occur as a result of their oversight. Hopefully it will come to someone's attention.
- cjg 16y agoLet us know how it turns out.
- froo 16y agoWell now that they've fixed it, I guess I can say where I saw the error. The error was on the Financial Ombudsman website in Australia in their online dispute form. The reason why this concerned me was that some of the information they need to collect included things like bank account numbers - so having this information sent insecurely to the Ombudsman was (imho) a big no-no. I guess I finally managed to get through to someone who can fix it after I sent emails directly to the chief Financial Ombudsmen explaining exactly why it was an issue, with screenshots showing exactly where the problems were (I highlighted the appropriate parts) and an example explaining exactly how someone could use this information to engineer someone's account passwords out of them easily. Thankfully its all fixed now.