3 ms·
The problem was that some average developer was lazy and do whatever that worked, with no concern about potential security implications.
by lominming 13y ago
The problem was that some average developer was lazy and do whatever that worked, with no concern about potential security implications.
- Percein 13y agoIt looks like their customer service ticketing system is wide open too: http://www.google.com/search?q=www.clkbank.com/viewTicket.htm http://www.google.com/search?q=www.clkbank.com/viewTicket.ht...
- frogpelt 13y agoFirst relevant result refers to the fact that customer's info is available for public viewing. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E26163B74B75F4CB6A40F0EB940A8681A1B750975B6AFE0794483F2C8C7959162116443A4E21BDD341D1F128358 https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...
- Lutinger 13y agoWhat a total breach of customer privacy. I can't imagine customers want it to be searchable that they purchased a "Customized Fat Loss Program" https://www.clkbank.com/viewTicket.htm?key=01.71E027164BE509B234D213BBA2EBF65233445C7A686DA1A030280CEC7259A0632752D0B0 https://www.clkbank.com/viewTicket.htm?key=01.71E027164BE509...
- Lutinger 13y agoAnd this customer support ticket shows a customer complaining about the fact that their order information is visible on the internet. This was back in 2011. ClickBank has to have known about this hole for years and hasn't addressed it. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E26163B74B75F4CB6A40F0EB940A8681A1B750975B6AFE0794483F2C8C7959162116443A4E21BDD341D1F128358 https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...
- apalmer 13y agoCan only hazard a guess that this must be some bizarre form of SEO or something, because this is a known issue that could be fixed in probably 30 minutes max, which they have received complaints for...
- mmanfrin 13y agoHello Sandy, ClickBank.com is a secure site. The only way someone would be able to look up your order, which does not show any payment detail except your Credit Card type and last 4 digits on the card, is to know the exact order number and email address. Closing this ticket, because new tickets for each order, requesting a vendor authorization for refunds have been opened. These orders are 116 days old and ClickBank.com is not able to issue a refund for order over 60 days old. Best regards, Jutta ClickBank.com Customer Support http://www.clickbank.com/help/ http://www.clickbank.com/help/
- sizimon 13y ago"ClickBank.com is a secure site. The only way someone would be able to look up your order, which does not show any payment detail except your Credit Card type and last 4 digits on the card, is to know the exact order number and email address." Strange, because the link in the ticket to the order still works and is viewable without any of that information.
- systematical 13y agoNo, not lazy. Being lazy would have been doing a simple session check and then redirecting to a login page if the session user id did not match the user id in the order. The developer had no idea what he/she was doing. Brutal.
- karolist 13y agoYou have me listening. What would be the correct course of action while not lazy and knowing what you're doing? I know that "knowing what you're doing" and this question doesn't go together, but still anything better than a check/redirect?