Saints Superstore login insecure? : Sun Oct 10, 2010 8:27 am  

Not sure if anyone's noticed this before, or even if it is worthy of all that much concern. The superstore login page at: Code: Select all http://www.saintssuperstore.com/customer/account/login/ Has the following login form: Code: Select all <form id="login-form" method="post" action="http://www.saintssuperstore.com/customer/account/loginPost/"> with the following inputs: Code: Select all <input type="text" name="login[username]" ... <input type="password" name="login[password]" ... As you can see, your username and password is sent in the clear over "http" and not securely over "https". If you use Firebug or something to change the action URL to "https" then you get an error as that URL isn't available on "https". I emailed Saints about this several months ago but didn't receive a reply. Cause for concern?

Not sure if anyone's noticed this before, or even if it is worthy of all that much concern. The superstore login page at: Code: Select all http://www.saintssuperstore.com/customer/account/login/ Has the following login form: Code: Select all <form id="login-form" method="post" action="http://www.saintssuperstore.com/customer/account/loginPost/"> with the following inputs: Code: Select all <input type="text" name="login[username]" ... <input type="password" name="login[password]" ... As you can see, your username and password is sent in the clear over "http" and not securely over "https". If you use Firebug or something to change the action URL to "https" then you get an error as that URL isn't available on "https". I emailed Saints about this several months ago but didn't receive a reply. Cause for concern?

Re: Saints Superstore login insecure? : Sun Oct 10, 2010 8:42 am  

I have no idea what all that means lol

Re: Saints Superstore login insecure? : Sun Oct 10, 2010 9:34 am  

Yes. If it contains financial details the login credentials should be encrypted.

Very amateaurish really.

Re: Saints Superstore login insecure? : Sun Oct 10, 2010 9:42 am  

My sis works for EMS Internet who does the store side of the site. Il let her know to tell the tech guys

Re: Saints Superstore login insecure? : Sun Oct 10, 2010 6:51 pm  

This could be an issue if the financial details are kept stored on the profiles. Saints should definately be looking into it.

Re: Saints Superstore login insecure? : Sun Oct 10, 2010 7:41 pm  

Cheers for the heads up. I'm now £212,500 richer.

I even put the debit from your credit cards down 'Regards, Ski retail inc'.

Re: Saints Superstore login insecure? : Sun Oct 10, 2010 7:58 pm  

kinkyjohn wrote:

Not sure if anyone's noticed this before, or even if it is worthy of all that much concern....

Yes, definitely of concern. They should be using https. That is so bad. I'm glad I've never ordered anything online from Saints!

Re: Saints Superstore login insecure? : Mon Oct 11, 2010 6:57 am  

Wasn't big mac on the board of directors for an IT security company

Re: Saints Superstore login insecure? : Mon Oct 11, 2010 8:36 am  

Also it doesn’t comply with PCI compliance. So the credit card company/banks could remove the credit card facility from Saints. If anyne from the club reads this we can help. http://www.networkdefence.com

Also it doesn’t comply with PCI compliance. So the credit card company/banks could remove the credit card facility from Saints. If anyne from the club reads this we can help. http://www.networkdefence.com

Re: Saints Superstore login insecure? : Mon Oct 11, 2010 5:30 pm  

Bizarre, the layout changed today on the store for the ISC stuff and now its back to how it was before.

It showed Wilkin and Roby in ISC branded polo shirt and t-shirt with the new Saints badge.

I have a screen shot on my work pc.