3 ms·
Someone posted a great link to an article at the consumerist. I've managed to guess their email naming convention using a google search, so have sent off a deta
by froo 16y ago
Someone posted a great link to an article at the consumerist. I've managed to guess their email naming convention using a google search, so have sent off a detailed email of the problem to their executives trying to "dumb it down" as much as possible by including screenshots and a basic outline of a social engineering strategy (including a nightmare outcome) that might occur as a result of their oversight.
Hopefully it will come to someone's attention.
- cjg 16y agoLet us know how it turns out.
- froo 16y agoWell now that they've fixed it, I guess I can say where I saw the error. The error was on the Financial Ombudsman website in Australia in their online dispute form. The reason why this concerned me was that some of the information they need to collect included things like bank account numbers - so having this information sent insecurely to the Ombudsman was (imho) a big no-no. I guess I finally managed to get through to someone who can fix it after I sent emails directly to the chief Financial Ombudsmen explaining exactly why it was an issue, with screenshots showing exactly where the problems were (I highlighted the appropriate parts) and an example explaining exactly how someone could use this information to engineer someone's account passwords out of them easily. Thankfully its all fixed now.