Bronsonbull
Expert
Mods, feel free to move this thread (wasn't sure where it should go).
I'm curious to see what our members think of this:
Here's my main issue with Sportsman's Guide: Their "order status" page on their web-site is highly insecure. It's BS if you ask me and why I won't shop there anymore. All you have to do is enter a last name and a zip code and it will give you the order history of those people (what they bought, when they bought it, scheduled delivery date and the person's address). That's pretty scary. If the bad guys were smart, they could use this to find out when stuff was going to be delivered and be waiting on the porch to sign off on it. Or, they know who owns a lot of ammo or different firearms. Maybe I'm paranoid, but this is scary to me. I tried some "Johnsons" and "Smiths" with the surrounding zip codes and found a lot of orders.
Try is for yourself:
http://www.sportsmansguide.com/net/OrderStatus/OrderDisplayNew.aspx
They have received numerous complaints about this and have decided not to change it because a lot of people like how easy it is to look up their order status. Security does get in the way of "easy", but security is far more important IMHO. They should at least make you enter your order number (something that only you should have).
I'm curious to see what our members think of this:
Here's my main issue with Sportsman's Guide: Their "order status" page on their web-site is highly insecure. It's BS if you ask me and why I won't shop there anymore. All you have to do is enter a last name and a zip code and it will give you the order history of those people (what they bought, when they bought it, scheduled delivery date and the person's address). That's pretty scary. If the bad guys were smart, they could use this to find out when stuff was going to be delivered and be waiting on the porch to sign off on it. Or, they know who owns a lot of ammo or different firearms. Maybe I'm paranoid, but this is scary to me. I tried some "Johnsons" and "Smiths" with the surrounding zip codes and found a lot of orders.
Try is for yourself:
http://www.sportsmansguide.com/net/OrderStatus/OrderDisplayNew.aspx
They have received numerous complaints about this and have decided not to change it because a lot of people like how easy it is to look up their order status. Security does get in the way of "easy", but security is far more important IMHO. They should at least make you enter your order number (something that only you should have).