epass: was there a security breach?

[rowan]

http://www.gofuckyourself.com/showthread.php?t=599968

No response to my question in this thread... usually if there's a wholesale change of passwords it means there's been a breach. I can't imagine that you would not have recent db backups.

I'm happy to be proven wrong! Please clarify!

[pstation]

been wondering this myself, if there really was some sort of DB corruption I'd think they could just rollback the passes to before they were messed up. but then again, i have absolutely no clue how their system works

[woj]

[minusonebit]

been wondering this myself, if there really was some sort of DB corruption I'd think they could just rollback the passes to before they were messed up. but then again, i have absolutely no clue how their system works

All databases work relatively the same. Either they were too stupid to keep backups (not out of the question for them) or they were hacked. Only two possible explanations.

They have carefully avoided this question everytime I or anyone else has posted it. Silence is always an admission of guilt. So we can conclude that there was a breach. Only we dont know how bad.

[crockett]

If there had been a breech, wouldn't they legally have to notify all users? After all peoples credit card and personal info could have been compromised and I'd think they would legally have to let us know, or they could be held labial.

[HairToStay]

Not all passes were lost though .... I have 2 accounts and my oldest account was fine, but the one I opened in the past 6 months had a password change.

[Michael O]

I was told it was a database issue and thats what I have been posting, I have posted everything I know.

[rowan]

I was told it was a database issue and thats what I have been posting, I have posted everything I know.

Could you perhaps ask for more information from your bosses?

BTW I'm not blaming you for what has happened. I'm just concerned about the security of my details.

[V_RocKs]

My password on 3 accounts did not change so there was no complete rollover of passwords... I know a lot of people who say they had no issue during the problem so it looks like a DB issue...

To the person who thinks you can just roll shit back, you are a shithead... ;)

[woj]

To the person who thinks you can just roll shit back, you are a shithead... ;)

If everything was backed up as it should have been, I don't see any reason why it would be impossible to recover data from a backup.. Can you clarify why you think it would be impossible to recover data from a backup in this situation?

[minusonebit]

Could you perhaps ask for more information from your bosses?

Yes, this would be nice. Its almost always better to tell what really happened than to make the customer wonder about it.

[rowan]

To the person who thinks you can just roll shit back, you are a shithead... ;)

I'm sure it would have been relatively simple to restore only password hashes and include a note on the "wrong username or password screen" to the effect that people who changed their password recently have to request a new one via <link>. Certainly much easier than having thousands of users having password issues.

[DamageX]

I'm sure it would have been relatively simple to restore only password hashes and include a note on the "wrong username or password screen" to the effect that people who changed their password recently have to request a new one via <link>. Certainly much easier than having thousands of users having password issues.

After all your (and everyone else's) dealings with epassporte, don't you think that would make a bit too much sense?

[shaliza]

http://www.gfy.com/showthread.php?t=602765

[madawgz]

epassporte wouldnt let anything happen to your money

[minusonebit]

epassporte wouldnt let anything happen to your money

Yeah, right.

[European Lee]

epassporte wouldnt let anything happen to your money

Regards,

Lee

[Michael O]

Yeah, right.

minusonebit.

I don't understand your other thread:
http://www.gfy.com/showthread.php?t=602765

You say we send you a new password and you logged in to change the password to your old but your account were not affected by this database issue.
Are you just posting to trying to create drama where there is none?
You were told what happened with the database issue now if you have any real problems or questions about your account you are welcome to contact me directly or post them here.

[Michael O]

Regards,

Lee

Please see my reply to minusonebit.

Did you ever pay what you owed to the designer and what happened to the email list you got from Oprano?

[Michael O]

I am seriously tried of this BS if you want the gloves to come off go ahead guys.

I am all for constructive critism and I will try to help anyone with any problems or questions they might have but I am not going to sit back and watch you two or anyone else continue this BS.
Enough is enough.

[Michael O]

As always if you have any real concerns or questions both Shaliza and myself are here to answer them.

[Furious_Male]

Don't let them see you sweat.

[European Lee]

Don't let them see you sweat.

To late



Regards,

Lee

[GiveIntoMe]

Regards,

Lee

LOL LOL LOL LOL LOL LOL LOL

you gotta win that $1k from Epassporte for that.

[minusonebit]

minusonebit.

I don't understand your other thread:
http://www.gfy.com/showthread.php?t=602765

You say we send you a new password and you logged in to change the password to your old but your account were not affected by this database issue.
Are you just posting to trying to create drama where there is none?
You were told what happened with the database issue now if you have any real problems or questions about your account you are welcome to contact me directly or post them here.

I think I have very clearly stated my problem and your implying that I made it up to create fake drama really pisses me off. Let me summarize my issue for you, since you didnt seem to get it all down:

I woke up one day and made a purchase with my ePass virtual card from APMEX.com. A charge was authorized. APMEX requires that all orders be shipped to the address on file. A couple of days after the intial order, I called APMEX to see why the order was still pending. They explained to me that ePass sent them an AVS response of "global". They said that because of this, they put the order on pend and canceled the auth.

I explained to APMEX I would get it straightened out and call them back. I tried to login to my ePass account several times. I could not get in. I was sure I was using the right password. So I opened up GFY to see if there was an issue. Sure enough, there was an "epass down" thread. I read, I appeared to have the symptoms that were described, so I used the link to reset the password as instructed. Boom, account can be gotten into.

Once into my account, I could see the pending auth and I posted for support in getting the auth removed. We went around and around on the auth issue.

While I was trying to get into my account, APMEX was calling you and asking how they could get the auth off my card and they also wanted ePass to verify my address, which they eventually did. You told APMEX to fax you a release form. Which they did. APMEX faxed you the release form twice (in addition to voiding the auth as VisaNet specs provide for) and it didnt get removed until I called in and yelled at someone there and posted here and ICQd you similtaniously. Finally, the auth was removed, APMEX was satisified that the order was OK so they re-ran the charge and accepted the order despite the "global" AVS flag. Yiou later explained in your ICQ convo that ePassporte does not support AVS.

Then last night I made my little password discovery. It seemed to indicate that ePass wasnt being truthful so I decided to post it here for the community to digest. Someone from ePass came along and posted a relatively reasonable (but unverifiable) explanation for all the trouble. Given the fact that ePassporte has a shady reputation (alot like iBill, only not quite as bad yet) I dont know whether to belive it or not. But I am not one to call someone a liar unless I am sure I am on solid ground, and as such, I consider it truth until I see evidence to the contrary. I said as much in 'my' thread.

And thanks for your permission to contact your support team or post for support. I appreciate that. Silly me, I thought thats what I got when I was a paying customer. But thanks, I feel much better now that I have your permission to contact support. Right now, my only unresolved issue is your condescending remarks, which you are free to apologize for any time you like at which time that issue too will be considered closed.

[minusonebit]

I am seriously tried of this BS if you want the gloves to come off go ahead guys.

Hey pal, let me let you in on a little secret: The gloves are ALWAYS off when it comes to other people fucking around with my money. And I am sure most everyone else here takes about the same approach.

For the reasons explained in the last post, my issue was legitimate and your job is to resolve legitimate issues.

If you dont like your job, then quit.

[BSleazy]

If everything was backed up as it should have been, I don't see any reason why it would be impossible to recover data from a backup.. Can you clarify why you think it would be impossible to recover data from a backup in this situation?

Why not just re-issue passwords to make sure there's no problems?

[BSleazy]

By the way I love Epassporte. Never had a problem with anything at all. Had to call support once and that issue was taken care of immediately.

[OzMan]

... or they could be held labial.

I met three Epassporte employees at Internext who I would be more than willing to to hold labially anytime.

[Michael O]

Given the fact that ePassporte has a shady reputation (alot like iBill, only not quite as bad yet)

Are you comparing ePassporte to IBill?
Tell me about one person that haven't gotten their money from ePassporte?
Or how you think ePassporte compare to IBill

It seemed to indicate that ePass wasnt being truthful so I decided to post it here for the community to digest.

The title of your thread were "ePassporte: Another Lie. Proof Inside. (Drama) (Pics)"

But I am not one to call someone a liar unless I am sure I am on solid ground, and as such, I consider it truth until I see evidence to the contrary. I said as much in 'my' thread.

The title of your thread were "ePassporte: Another Lie. Proof Inside. (Drama) (Pics)"
When did ePassporte lie about what happened?

And thanks for your permission to contact your support team or post for support. I appreciate that. Silly me, I thought thats what I got when I was a paying customer. But thanks, I feel much better now that I have your permission to contact support. Right now, my only unresolved issue is your condescending remarks, which you are free to apologize for any time you like at which time that issue too will be considered closed.

It was a statement letting anyone know that if they have problems or questions we are here to help and people shouldn't hesitate to contact us, if you read it another way I apologize for not making myself more clear.

Yiou later explained in your ICQ convo that ePassporte does not support AVS.

I also asked if that could be the explanation in one of the earlier threads where you posted about the issue you had:
http://www.gfy.com/showthread.php?t=601168

If you dont like your job, then quit.

I do like my job but I am not going to sit back and watch people continue to bash ePassporte.

[minusonebit]

You know what Keyser Soze? Go fuck yourself.

I am not going to get into a flame war here. I'm not making money on this thread and so its a waste of my time. I just bought another website yesterday and it will make money if I work on building it, so I will focus on that.

Like I said:

Then last night I made my little password discovery. It seemed to indicate that ePass wasnt being truthful so I decided to post it here for the community to digest. Someone from ePass came along and posted a relatively reasonable (but unverifiable) explanation for all the trouble. Given the fact that ePassporte has a shady reputation (alot like iBill, only not quite as bad yet) I dont know whether to belive it or not. But I am not one to call someone a liar unless I am sure I am on solid ground, and as such, I consider it truth until I see evidence to the contrary. I said as much in 'my' thread.

I am comparing ePassporte to iBill in the way that both have a reputation of being incomptent and constantly fucking things up. One only needs to conduct a search on this board to see that statement holds water.

I am not bashing ePassporte. ePassporte took a shit on the rug and I put ePassporte's nose in it. The shit has been removed from the rug (only the stain is left, the stain being your snide comments) and so the issue is over with as far as I am concerned until my account gets fucked up again.


We're not gonna go back and forth on this like two little kids. Well, you can, but you'll be talking to yourself.

[minusonebit]

And one last thing, Keyser Soze: I didnt see your post to that thread until just now. Had you told me that right off the batt, it would have saved alot of problems.

But none the less, your managers are ultimately to blame for this then because they should have never turned you loose on the floor if you dont even know the basic compnents of a transaction. Its a major disservice to both employee and customer when managers throw people into support roles without making sure they know whats going on.

[rowan]

bump4drama

ok, I'm not really interested in the drama, I just want to know that my details are safe. Keyser, please ask your bosses if they can give us any more details. As a good netizen - particularly one who has CC and bank account details on file - there should at least be some disclosure of any security breaches.

Again, I am happy to be proven wrong if it's not that...

[prime]

did anyone lose a buck due to this issue?
if not then get over it

[fris]

epass makes my life easier since paypal doesnt take adult