5 ms·

I guess I'm the odd one out on this, but why not send your competitor an email and let him know what he's doing is risky and dangerous. Perhaps he doesn't know?

• deleted 12y ago
  [deleted]
  • deanclatworthy 12y ago
    Remember your competitors are people too. They most likely have families and bills to pay. A polite email would go along way.
    • pc86 12y ago
      The vast majority of people have families, and everyone has bills to pay. That doesn't change the fact that he's risking the financial future of dozens/hundreds/thousands of people by failing to take even the most basic precautions. This is dangerous and if the fastest way to fix it puts him out of business, so be it. I would absolutely put the financial safety of thousands of customers over the financial safety of one business owner.
      • toomuchtodo 12y ago
        > That doesn't change the fact that he's risking the financial future of dozens/hundreds/thousands of people by failing to take even the most basic precautions. If the company in question is storing personal financial details on users? Sure. But credit card numbers? Please. Home Depot lost 56 million CC numbers, and the world did not come to a screeching halt.
        • gorbachev 12y ago
          The world might have not come to a screeching halt, but if even one of the owners of those credit cards got their identity stolen, that person's life probably was/will be a living nightmare for years. It's exceedingly hard to clear up identity theft. It takes years, and an enormous amount of time that's taken out of your personal and work time.
        • pc86 12y ago
          You have clearly never had your identity stolen. It consumes you. Dealing with the direct fallout and the associated bullshit is your entire life for years. You think about it when you wake up, during meals, spending time with friends and family, every time you swipe a card for any transaction, and every time you log into any financial account online.
      • deanclatworthy 12y ago
        The fastest way to fix a problem is to tell the developers. Not get the authorities involved. I agree, it's negligent but at least give people the opportunity to fix their mistakes, and maybe even inform their customers. I suppose we should shut down every business that makes a mistake with customer information. You can therefore shut down Microsoft, Ebay and all the other organisations that have had data breaches in recent years due to negligence.
    • rational-future 12y ago
      Remember the people who send polite emails to their competitors never get to build empires like Microsoft, Apple, Google, Oracle or Amazon.
      • Silhouette 12y ago
        Perhaps, but at least they can look at themselves in the mirror the next morning. It's a sad world when you can't send someone who (as far as I can see so far) may just have made an honest mistake or hired the wrong "expert" help a friendly mail, to warn them of something you have (apparently legitimately) discovered that could get them and/or their customers in trouble, all because CYA and Fear The Lawyers. So I vote for sending the quiet e-mail first, for the same reasons as I'd privately disclose any security vulnerability before making a public song and dance about it. The goal here apparently isn't to screw the other guy, it's to fix the problem. If you can do that by raising awareness courteously with the people who are best placed to apply that fix, isn't that a better strategy than shooting first and dealing with an industry that starts systematically concealing bad practice later?
• joshmlewis 12y ago
  This is the most interesting answer. On one hand business is business and if a competitor is truly doing something that is risking the livelihood of it's customers, that's not good and they should have a right to know and subscribe to a better service. On the other hand, he is human and might have had a developer that was clueless, etc. His reply would be key to determining which is true. If he purposefully did it to save costs, not caring, etc. then you have good reason to publicly call him out on it. If he truly was clueless and this is a big oh shit moment to him then you have a couple options you didn't otherwise have. If he doesn't have a big dev team (and if he does they seem incompetent) he might be willing to sell instead of spend the money to fix everything. There might also be some other creative solutions that would be beneficial for you rather than attacking it head on publicly.
• Klinky 12y ago
  This might be the nice thing to do, but anything that points back to him being the source of the complaint may not be best for him in the long run.
  • notwedtm 12y ago
    Why not? If the competitor decides not to take his advice, and he then reports him for violating PCI, he can say, "Hey look, i reached out via email to him and tried to help, he blew me off/didn't fix anything, so I then took steps to protect his customers, since he wasn't."
    • Klinky 12y ago
      It's about retaliation and legal issues. The guy could easily retaliate with a smear campaign or even take legal action saying he was "hacking" or doing "espionage". Whistleblowing often has negative consequences for the whistleblower.
• icebraining 12y ago
  On the other hand, if someone doesn't follow such an obvious practice, isn't there a good probability that they've fucked up in many other less visible ways? What's more likely - that the business owner will have a flash of realization and order a full security analysis of his software, or simply patch this problem (by hiding the CC) and leave the others unfixed (e.g. keep the numbers unencrypted)? And in any case, would a report really be likely to put him out of businesses for just this mistake? That doesn't seem in the interest of the people doing the analysis.
• deleted 12y ago
  [deleted]
• Pyxl101 12y ago
  Why would it put him out of business? Is there no way to clean everything up and get back into compliance? There have got to be PCI compliance strike team consulting companies that you can hire to come in and rapidly fix the problem.
• choppaface 12y ago
  The former customer and her/his bank have an honest interest in ensuring PCI compliance. Have the customer tell her/his bank/CC company, and have the customer optionally contact the business. In my experience, when I reported my landlord's management company for clear text passwords, my bank (BofA) followed up and the company rolled out PCI-compliant passwords in a couple months.
• noonespecial 12y ago
  This is what I'd do for an even more subtle reason. Wrecking his business this way could poison your own well of prospects. The customers of his that you could win just by being better might abandon your whole market segment with a "they're all crooks and incompetents... we only buy from IBM from now on" type attitude once they learn of a bungle this big.
• fubarred 12y ago
  Anonymously! Don't make yourself a target!
  • zamalek 12y ago
    This is the most important take-away here. Possibly communicate via a lawyer, whether you are giving a friendly heads-up or otherwise. This type of thing could be construed into conspiracy.
    • fubarred 12y ago
      Giga-up-vote. It's too easy to slip up on security hygiene and either lose a jobs, customers, investors, reputation &| be sued. There's just too many liabilities and it's hard to pull off without being (legally) interpreted as a threat. It is laudable to Do The Right Thing(TM), but the personal cost is likely nonzero sum. Be aware, tread carefully, CYA.
    • deleted 12y ago
      [deleted]