4 ms·
They could do some work on the (privacy) protection of those registries, for example by making the URLs of registry a little harder to guess. (Yeah, I know, add
by jschulenklopper 14y ago
They could do some work on the (privacy) protection of those registries, for example by making the URLs of registry a little harder to guess. (Yeah, I know, adding obscurity instead of security, but nevertheless).
I wanted to see an example list, didn't knew a valid first and last name to search for, so guessed
http://registrylove.com/registries/ http://registrylove.com/registries/
and some low ID number after that. Pronto!
I don't know if some Daisy & Javier mind that I can see their wishlist for their wedding. Personally I would have wanted to keep that list a little more private to only those people knowing I had registered my list at RegistryLove.
- masterzora 14y agoI'll admit I haven't dealt with wedding registries much at all (really, I watched somebody use a registry kiosk at a store once and that's about it) but I was always under the impression that registries are generally pretty much public.
- Kerrick 14y agoYou're right. If you know the first and last name of either the bride or the groom, and the store at which they registered, you can access their registry. This is by design--stores want it to be easy to find what the B&G want, because they want it to be easy for you to buy something for them.
- jschulenklopper 14y agoI could access a registry by guessing an ID (an ActiveRecord primary key, so just an integer), not searching for names. Agreed, this isn't very useful, but the list isn't protected/obscured if the URLs are that easy to guess. For example, at Amazon Universal Wishlist, the ID of a valid wishlist is very hard to guess -- like 6HV8XSTGDT3E7-difficult. On top, you can select whether you want that list to be public (discoverable via name search), visible if one knows the link, or private.