Affiliate program security? - GoFuckYourself.com

Libertine · 08-22-2003, 10:28 AM

Is it just me or is the security of affiliate programs extremely bad in many cases? Most don't use SSL when logging in, don't use encryption on stored passes, and very often allow people to change info from within the stats area without any different type of confirmation. Or they allow people to send changes in payment info through email, without actually confirming it.
(I actually tried a few times to change my account info on affiliate programs by sending an email with a spoofed "From:" field, and it worked in all cases. Anyone could do that, even with other people's accounts instead of their own)

shitstain · 08-22-2003, 10:29 AM

Quote:

Is it just me or is the security of affiliate programs extremely bad in many cases?

No, it's not just you

Sly_RJ · 08-22-2003, 10:43 AM

Last time I logged into TCG their login system really pissed me off. It seemed as if they were using GET because I could see both my login and password in the URL. I sent them an email about the problem, listing various problems this could cause (people changing your mailing information and password) but the tech who replied to my email didn't seem to care since all account changes are "verified".

I hope they've changed it since then...

bigdog · 08-22-2003, 10:45 AM

very bad when you consider you ssn number is in there and maybe your bank wire info

Libertine · 08-22-2003, 10:49 AM

So why isn't anything being done about it?

I and several other people I know have all had our account info for an affiliate program changed by someone else at one time or another. I myself am paranoid about it, and check it almost daily, so nothing happened apart from me changing every password I had. But still, it seems ridiculous that so little is done to prevent this sort of thing...

08-22-2003, 10:28 AM	#1
Libertine sex dwarf Join Date: May 2002 Posts: 17,860	Affiliate program security? Is it just me or is the security of affiliate programs extremely bad in many cases? Most don't use SSL when logging in, don't use encryption on stored passes, and very often allow people to change info from within the stats area without any different type of confirmation. Or they allow people to send changes in payment info through email, without actually confirming it. (I actually tried a few times to change my account info on affiliate programs by sending an email with a spoofed "From:" field, and it worked in all cases. Anyone could do that, even with other people's accounts instead of their own) __________________ /(bb\|[^b]{2})/

08-22-2003, 10:43 AM	#3
Sly_RJ Live Hard - Die Hard Join Date: Feb 2002 Location: Ready to leave... Posts: 17,042	Last time I logged into TCG their login system really pissed me off. It seemed as if they were using GET because I could see both my login and password in the URL. I sent them an email about the problem, listing various problems this could cause (people changing your mailing information and password) but the tech who replied to my email didn't seem to care since all account changes are "verified". I hope they've changed it since then... __________________ PHAT SERVERS - Quality dedicated hosting at a quality price! sly AT phatservers DOT com - 147479144

08-22-2003, 10:49 AM	#5
Libertine sex dwarf Join Date: May 2002 Posts: 17,860	So why isn't anything being done about it? I and several other people I know have all had our account info for an affiliate program changed by someone else at one time or another. I myself am paranoid about it, and check it almost daily, so nothing happened apart from me changing every password I had. But still, it seems ridiculous that so little is done to prevent this sort of thing... __________________ /(bb\|[^b]{2})/

08-22-2003, 10:45 AM	#4
bigdog Confirmed User Join Date: Jul 2001 Posts: 6,964	very bad when you consider you ssn number is in there and maybe your bank wire info