Re: Saints Superstore login insecure? : Mon Oct 11, 2010 7:47 pm  

Ell Saint Blues wrote:

Bizarre, the layout changed today on the store for the ISC stuff and now its back to how it was before.

It showed Wilkin and Roby in ISC branded polo shirt and t-shirt with the new Saints badge.

I have a screen shot on my work pc.

The shot appears to be back. Not sure about it myself tbh.

Re: Saints Superstore login insecure? : Mon Oct 11, 2010 7:58 pm  

Cringe

Cringe

Re: Saints Superstore login insecure? : Mon Oct 11, 2010 8:40 pm  

Saddened! wrote:

Cheers for the heads up. I'm now £212,500 richer.

I even put the debit from your credit cards down 'Regards, Ski retail inc'.

Re: Saints Superstore login insecure? : Wed Oct 13, 2010 12:25 pm  

Ski wrote: Cringe I don't actually think that's too bad

Ski wrote: Cringe I don't actually think that's too bad

Re: Saints Superstore login insecure? : Wed Oct 13, 2010 12:27 pm  

New ISC training range and home kit 2011 are listed as 'coming soon' on the site now, as well as the image of Wilkin and Roby wearing some new clobber as posted above by Mr Ski.

Re: Saints Superstore login insecure? : Wed Oct 13, 2010 2:12 pm  

How long did front line bathrooms and medi cash sign up for when they agreed the last sponsorship deal?

Re: Saints Superstore login insecure? : Wed Oct 13, 2010 10:32 pm  

kinkyjohn wrote: Not sure if anyone's noticed this before, or even if it is worthy of all that much concern. The superstore login page at: Code: Select all http://www.saintssuperstore.com/customer/account/login/ Has the following login form: Code: Select all <form id="login-form" method="post" action="http://www.saintssuperstore.com/customer/account/loginPost/"> with the following inputs: Code: Select all <input type="text" name="login[username]" ... <input type="password" name="login[password]" ... As you can see, your username and password is sent in the clear over "http" and not securely over "https". If you use Firebug or something to change the action URL to "https" then you get an error as that URL isn't available on "https". I emailed Saints about this several months ago but didn't receive a reply. Cause for concern? I complained to the club about this 18 months ago when I was ordering on line and suddenly appeared the details of everyone who had purchased on line that day e.g. name / address / what they bought etc but fortunately only the method of payment not their card details. I phoned the club and emailed but got no reply at all so posted on this forum a warning.

kinkyjohn wrote: Not sure if anyone's noticed this before, or even if it is worthy of all that much concern. The superstore login page at: Code: Select all http://www.saintssuperstore.com/customer/account/login/ Has the following login form: Code: Select all <form id="login-form" method="post" action="http://www.saintssuperstore.com/customer/account/loginPost/"> with the following inputs: Code: Select all <input type="text" name="login[username]" ... <input type="password" name="login[password]" ... As you can see, your username and password is sent in the clear over "http" and not securely over "https". If you use Firebug or something to change the action URL to "https" then you get an error as that URL isn't available on "https". I emailed Saints about this several months ago but didn't receive a reply. Cause for concern? I complained to the club about this 18 months ago when I was ordering on line and suddenly appeared the details of everyone who had purchased on line that day e.g. name / address / what they bought etc but fortunately only the method of payment not their card details. I phoned the club and emailed but got no reply at all so posted on this forum a warning.