I Hope You Don’t Have a Borders Rewards Card

Back in 2000 I worked on a website that had a secret page where you could enter any SQL statement in a textarea and it would be executed and the results returned to the page. This was claimed to be necessary for "debugging" and "support" but the only protection was that the URL was not linked anywhere else on the site.

I would not be so sure it's NOT security through obscurity. Whether it is or not, the Borders case is just another example of why it's no longer prudent to trust ANY online service with your personal data (though most of us would probably not think that signing up for a Borders Rewards card would create an online profile).

It's not security through security because I've discovered their SOAP end points that powered this front end, and from that discovered a ton of other Brierley clients that are vulnerable to similar issues.

Now trying to work out how to make the disclosure to Brierley.

Or it could have been a feature.

Back in 2000, I worked on the ecommerce site of a major consumer electronics manufacturer. One of the "features" that was implemented was for people that had an account, but hadn't logged in and had decided to proceed through the normal checkout process. When you entered your email address, it did a lookup at the accounts database and if that email address already existed, it logged you in as that user. Credit Card numbers weren't viewable, but were stored on the account.

Nobody understood why this was a bad idea until I ordered a digital camera to the head of internet marketing using his own account.

So are little companies, in many cases. Maybe it's just that we expect more from the big ones.

I'm sure plenty of small companies are shitty too but no one notices or cares as much. If a tiny website has a security breach, who's going to write about it? who would care enough to post it? How many up votes would it get?

We just hear about the large breaches because it affects more people.