🚀 go-pugleaf

Well at least his credit card number wasn't there I can see it now
���������� of unsolicited PC goods arriving on his door step.
Would seem to be a monumental cockup and another reason not to use CC over
the net
Mike

John Perry <JohnPerry@redoak.co.ukNOSPAM> wrote:

> My question is, how can I have been recognised as Paul on a secure site?
> This is worrying.

At a guess, some pleb has decided to identify people by their IP address
and you have been assigned the address that "Paul" was suing as your
dialup address or you use the same web cache and the address of the
cache is logged, which is even more worrying.  Or, your ISP's web cache
is storing copies of the pages this guy received and techdirect keep the
URLs the same for each page and adapt the content to the customer.
-- 
-> The email address in this message *IS* Valid <-

On Tue, 21 Mar 2000 at 23:49:59, mike <madcomputers@eircom.net> wrote in
demon.tech.pc:
(Reference: <tOTB4.1721$RC3.844@news.indigo.ie>)

>Well at least his credit card number wasn't there I can see it now
>���������� of unsolicited PC goods arriving on his door step.
>Would seem to be a monumental cockup and another reason not to use CC over
>the net
>Mike

I can't see it as a reason for not using a credit card, merely for not
using a bad supplier. The same would apply to using a credit card in any
restaurant because the waiters in some have misused customers' cards, or
not using a credit card for mail order by telephone because some mail
order suppliers have been know to misuse card information.

While you are at it, don't put your cash card into a machine, they have
been known to misuse the number and cheques can be forged so I wouldn't
use those. You could use cash but sometimes that turns out to be a
forgery.

You could use barter, but then you'd have to trust the person you were
exchanging with - which brings us back to square one.
-- 
John Underwood

John Underwood wrote:

> On Tue, 21 Mar 2000 at 23:49:59, mike <madcomputers@eircom.net> wrote in
> demon.tech.pc:
> (Reference: <tOTB4.1721$RC3.844@news.indigo.ie>)
>
> >Well at least his credit card number wasn't there I can see it now
> >���������� of unsolicited PC goods arriving on his door step.
> >Would seem to be a monumental cockup and another reason not to use CC over
> >the net
> >Mike
>
> I can't see it as a reason for not using a credit card, merely for not
> using a bad supplier. The same would apply to using a credit card in any
> restaurant because the waiters in some have misused customers' cards, or
> not using a credit card for mail order by telephone because some mail
> order suppliers have been know to misuse card information.
>

Not quite the same. Misuse of credit card by a restaurant assume some
dishonesty on the part of the waiter. And if he handles the card
carelessly, he could loose the facility. The e-cockup is more likely
to be caused by lack of training or just by bad software documentation.
Unfortunately this has exposed confidential information to an unknown
number of people, thus increasing the risk of misuse of that
information by somone somewhere. Most people are diciplined and
honest, but it just takes one rogue

Johannes

{$PW$}@womar.co.uk (Paul Womar) wrote:

>John Perry <JohnPerry@redoak.co.ukNOSPAM> wrote:
>
>> My question is, how can I have been recognised as Paul on a secure site?
>> This is worrying.
>
>At a guess, some pleb has decided to identify people by their IP address
>and you have been assigned the address that "Paul" was suing as your
>dialup address or you use the same web cache and the address of the
>cache is logged, which is even more worrying.  Or, your ISP's web cache
>is storing copies of the pages this guy received and techdirect keep the
>URLs the same for each page and adapt the content to the customer.

The problem is that Techdirect have not set a flag to prevent caching of
the https page, and they should fix it.

They never replied to my email either

-- 
John Perry:   JohnPerry@redoak.co.ukNOSPAM
              http://www.redoak.co.uk
PGP 2.6.2 public key available ** Delete NOSPAM in reply address **

"John Perry" <JohnPerry@redoak.co.ukNOSPAM> wrote in message
news:ufpfdso0vu2l1tl2pif4tco0ej0egv7eep@4ax.com...
> Posted to uk.computer.vendors and demon.tech.pc, my fav groups.
>
> Interesting experience tonight.  I looked at the TechDirect web site,
> and was recognised as a "Paul xxxxxxxxx" from Eyyyyyyyy where I
> apparently had an order in process.  I then moved to:
>
> https://www.techdirect.net/nexxxxxxxxxxxxxxxxx
>
> a secure website!! where Paul's home address, phone number, email
> address and other details were held.
>
> Also, details of the order were there.  Anyway, I phoned Paul up and
> told him about it, and have sent the full details to Techdirect for an
> explanation, which they may like to post here.
>
> My question is, how can I have been recognised as Paul on a secure site?
> This is worrying.
> --
> John Perry:   JohnPerry@redoak.co.ukNOSPAM
>               http://www.redoak.co.uk
> PGP 2.6.2 public key available ** Delete NOSPAM in reply address **

This happened to a colleague of mine about a year ago. He complained, they
assured him that they were fixing it. So a one year fix period, not bad,
maybe their Y2K checking got in the way)

--

Tony Wright

"Paul Womar" <{$PW$}@womar.co.uk> wrote in message
news:1e7vb5u.7yryzs1wfjk9xN%{$PW$}@womar.co.uk...
> John Perry <JohnPerry@redoak.co.ukNOSPAM> wrote:
>
> > My question is, how can I have been recognised as Paul on a secure site?
> > This is worrying.
>
> At a guess, some pleb has decided to identify people by their IP address
> and you have been assigned the address that "Paul" was suing as your
> dialup address or you use the same web cache and the address of the
> cache is logged, which is even more worrying.  Or, your ISP's web cache
> is storing copies of the pages this guy received and techdirect keep the
> URLs the same for each page and adapt the content to the customer.

I thought secure pages were not supposed to be cached anyway? Only stuff on
port 80?
The IP address being recognised sounds a reasonable explanation, although
not excusable!

--
Hywel Mallett

On Wed, 22 Mar 2000 John Underwood wrote;
>
>I can't see it as a reason for not using a credit card, merely for not
>using a bad supplier. The same would apply to using a credit card in any
>restaurant because the waiters in some have misused customers' cards, or
>not using a credit card for mail order by telephone because some mail
>order suppliers have been know to misuse card information.
>
>While you are at it, don't put your cash card into a machine, they have
>been known to misuse the number and cheques can be forged so I wouldn't
>use those. You could use cash but sometimes that turns out to be a
>forgery.
>
>You could use barter, but then you'd have to trust the person you were
>exchanging with - which brings us back to square one.

And don't use banks; one of them once debited my account with two
bounced cheques drawn by someone with a similar name to mine (there was
hell to pay).

(Bob
-- 
 >---B---------|  The computer is an idiot,          |---NB - "News"--->
    Goddard    |  It knows not how nor when.         | may be updated   
 >---b---------|  In fact the only thing it knows    |---occasionally--->
                  Is one plus one makes ten.

On Wed, 22 Mar 2000 at 18:17:12, John Perry
<JohnPerry@redoak.co.ukNOSPAM> wrote in demon.tech.pc:
(Reference: <de3idscqce5l0lhdvraap5b17enti54aif@4ax.com>)

>The problem is that Techdirect have not set a flag to prevent caching of 
>the https page, and they should fix it.
>
>They never replied to my email either

Do they sell second-hand cars?
-- 
John Underwood

The problem was not due to an https inconfiguration, but rather a login
feature of Microsoft Site Server. This feature has now been removed, so
the resulting problem won't
reoccur. Other sites using the MS Site Server package such as Barnes
and Noble, Dell and Microsoft Online Store would have experienced
similar issues.
We are sorry for the inconvenience caused.
webmaster
Tech Direct Europe plc.


Sent via Deja.com http://www.deja.com/
Before you buy.

In article <8bn8fc$e1f$1@nnrp1.deja.com>,
	webmaster@techdirect.net writes:
> The problem was not due to an https inconfiguration, but rather a login
> feature of Microsoft Site Server. This feature has now been removed, so
> the resulting problem won't
> reoccur. Other sites using the MS Site Server package such as Barnes
> and Noble, Dell and Microsoft Online Store would have experienced
> similar issues.

use of the word feature duly noted :(

-- 
Martin Smith