solarforceflashlight-sales.com - member list accessible by public

70 posts / 0 new
Last post

Pages

Rod911
Offline
Last seen: 1 month 3 days ago
Joined: 08/25/2011 - 20:36
Posts: 456
Location: Melbourne
solarforceflashlight-sales.com - member list accessible by public

It started with me Googling my own name. Yeah, I had a few minutes to spare this morning. I have a pretty unique first name and surname, so, usually, there isn’t that many hits that show up on Google or it has been the same/usual suspects (ie. Facebook and my LinkedIn account).

Any way… to my surprise, lo and behold, I find my solarforceflashlight-sales account pop up. It only shows my real name and my email address, along with everyone else who has made an online account with them. No you cannot access any other information but name and email address, but, someone who is more knowledgeable than myself, probably could find a backdoor into there if they tried.

Poor form.

I’ll shoot them an email to let them know of their security lapse. This is just an FYI for members here who might consider making some changes to their online account with them if they don’t want people to know their real name or email address.

Edited by: sb56637 on 05/07/2014 - 15:33
AlexGT
AlexGT's picture
Offline
Last seen: 3 hours 8 min ago
Joined: 06/07/2012 - 17:39
Posts: 4450
Location: Texas

Sure enough, Google your name and add solarforce and the first hit is a list with all the name and emails, such carelessness deserves none of my cash. |(

AlexGT
AlexGT's picture
Offline
Last seen: 3 hours 8 min ago
Joined: 06/07/2012 - 17:39
Posts: 4450
Location: Texas

Sent them an email, probably PayPal and visa should look into it too since someone more tech savvy might access some other parts like purchase history and payment info, maybe we should notify the other forums about it.

Helios-
Helios-'s picture
Offline
Last seen: 1 year 3 months ago
Joined: 01/18/2012 - 21:12
Posts: 2099

Lets see how long it takes for them to fix it.


Counterfeit 18650s, 2,<a href=“http://

MRsDNF
MRsDNF's picture
Offline
Last seen: 2 months 1 week ago
Joined: 12/22/2011 - 21:18
Posts: 13473
Location: A light beam away from the missus in the land of Aus.

I have emailed them with a link to this thread. Lets see if we get a response.

 

djozz quotes, "it came with chinese lettering that is chinese to me".

                      "My man mousehole needs one too"

old4570 said "I'm not an expert , so don't suffer from any such technical restrictions".

Old-Lumens. Highly admired and cherished member of Budget Light Forum. 11.5.2011 - 20.12.16. RIP.

 

flashination
Offline
Last seen: 2 years 2 months ago
Joined: 09/19/2011 - 04:08
Posts: 828
Location: Texas
|( A least they responded quickly, allthough the error is very serious. Pardon my tone of language on deleted post.

 

 

 

 

 
 
'I pledge not to get drawn into cpf/blf arguments, & just understand that both places have their own merits'.

AlexGT
AlexGT's picture
Offline
Last seen: 3 hours 8 min ago
Joined: 06/07/2012 - 17:39
Posts: 4450
Location: Texas

Notified PayPal about it too

flashination
Offline
Last seen: 2 years 2 months ago
Joined: 09/19/2011 - 04:08
Posts: 828
Location: Texas

Deleted

 

 

 

 

 
 
'I pledge not to get drawn into cpf/blf arguments, & just understand that both places have their own merits'.

relic38
relic38's picture
Offline
Last seen: 3 years 2 months ago
Joined: 12/28/2012 - 00:39
Posts: 3390
Location: Toronto, Canada

Well that sucks.

Edit: Found myself, and a couple of others I know by name. Gonna see if I can delete my account now…
Edit2: Couldn’t delete, so changed my name to initials. (tip: log out and back in to confirm the change).

Edit3: I recommend everyone do this to ensure their real name stops being crawled in association with their PP account email.

Welcome the night.

My Reviews   My Mods    http://budgetlightforum.com/search?

MountainKing
Offline
Last seen: 1 week 1 day ago
Joined: 12/01/2011 - 03:20
Posts: 2276
Location: Lost Islands ™

I did a check like that before too with my first name + surname and then with my surname.

My surname is a common one in the muslim world so nothing gets related to me. With my complete name, I was finding it a bit disturbing that my every likes and talk in public groups in facebook was being available on google. So I just changed my real name to a pseudo name on facebook. Problem solved.

Never ever forget and forgive. Niwal**er new kid on the block trying to act tough.
http://budgetlightforum.com/node/24847
Do not support this brand.

DINODIRECTSCAM COMPANY. DO NOT BUY
http://budgetlightforum.com/node/11324?page=2#comment-254983

rojos
Offline
Last seen: 5 years 2 weeks ago
Joined: 07/18/2012 - 19:22
Posts: 996

I stopped buying from IOS after its security blunder. I will stop buying from SF Sales now as well.

Leaving the customer list visible like that is a massive snafu. SMH.

Ejected Filament
Ejected Filament's picture
Offline
Last seen: 1 week 1 day ago
Joined: 12/03/2013 - 04:29
Posts: 2343
Location: Qld, Australia

Its an Admin page of some kind. Sadly changing your details doesnt seem to work, not immediately at least. I tried it a couple of hours ago, cleared my cache, still comes up with my original reg name. Might work eventually though so its still worth trying it.

Lucky for me, I never use my full name anyway.

Ramblings
Ramblings's picture
Offline
Last seen: 1 week 3 days ago
Joined: 01/09/2013 - 04:05
Posts: 761
Location: Australia

I'm thinking the admin forgot to tell Google not to cache the page, so Google has cached a page meant to be accessible only by admin rights.

You are the light of the world. Like a city on a hill, you cannot be hidden.
People do not light a lamp and then hide it away, instead they put it where it gives lig

Helios-
Helios-'s picture
Offline
Last seen: 1 year 3 months ago
Joined: 01/18/2012 - 21:12
Posts: 2099

Its accessible directly from solarforceflashlight-sales.com. Its not just a google cache copy.

Seems to be fixed.
~ edit ~
(link deleted) Might still be vulnerable.


Counterfeit 18650s, 2,<a href=“http://

Ejected Filament
Ejected Filament's picture
Offline
Last seen: 1 week 1 day ago
Joined: 12/03/2013 - 04:29
Posts: 2343
Location: Qld, Australia

Still coming up on Google though

Helios-
Helios-'s picture
Offline
Last seen: 1 year 3 months ago
Joined: 01/18/2012 - 21:12
Posts: 2099

Its going to come up on google until they crawl solarforceflashlight-sales.com again.


Counterfeit 18650s, 2,<a href=“http://

Gj
Gj's picture
Offline
Last seen: 1 day 31 min ago
Joined: 06/26/2013 - 15:44
Posts: 3066
Location: NY,USA

Free DIY website design? Laughing

http://www.webs.com/

MountainKing
Offline
Last seen: 1 week 1 day ago
Joined: 12/01/2011 - 03:20
Posts: 2276
Location: Lost Islands ™

They have about 564*15 = 8460 buyers Smile

Never ever forget and forgive. Niwal**er new kid on the block trying to act tough.
http://budgetlightforum.com/node/24847
Do not support this brand.

DINODIRECTSCAM COMPANY. DO NOT BUY
http://budgetlightforum.com/node/11324?page=2#comment-254983

ChibiM
ChibiM's picture
Offline
Last seen: 29 min 39 sec ago
Joined: 05/09/2011 - 10:25
Posts: 6549
Location: Holland

Don't spread the word...let them solve this asap before more people can "use" this..

Please  dont post on other forums yet.

Boaz
Boaz's picture
Offline
Last seen: 2 hours 8 min ago
Joined: 11/07/2010 - 09:31
Posts: 7536
Location: Birthplace of Aviation

I hate to make accounts with these stupid vendors  .I just pay with paypal and avoid their silly promotions ,points etc . the fact they ask for your phone number is just retarded .i've never given the correct number yet ... Welcome to the internet .

       καὶ τὸ φῶς ἐν τῇ σκοτίᾳ φαίνει καὶ ἡ σκοτία αὐτὸ οὐ κατέλαβεν

                            

       Dc-fix diffuser film  >…  http://budgetlightforum.com/node/42208

ToyKeeper
ToyKeeper's picture
Offline
Last seen: 11 hours 24 min ago
Joined: 01/12/2013 - 14:40
Posts: 10644
Location: (469219) 2016 HO3

Rod911 wrote:
No you cannot access any other information but name and email address

Wrong.

I found myself on their list, and without being logged in in any way, I am able to see the name, email, physical address, phone number, and full purchase history of every user on the list. It looks like I can also edit their accounts, though I didn’t try to save any changes. It seems that other admin functions are available too, simply by following the link from google.

For that matter, it seems I have access to edit their product listings, authorized dealer lists, … Hey, looks like someone else has already edited that; they added an entry which is an all-caps profane insult.

Hmm. Looking around further, it seems others have probably noticed too. Check out their news page:
http://www.solarforceflashlight-sales.com/new.php

I think it’s safe to say it’s totally broken and they need to fix it ASAP.

Edit: When I checked the news page again, the article asking their admin to fix the admin access was gone. Looks like someone there is probably working on it.

raccoon city
raccoon city's picture
Offline
Last seen: 11 hours 36 min ago
Joined: 10/06/2010 - 02:35
Posts: 15338
Location: रॅकून सिटी Palm Desert CA USA

Rod911 wrote:
solarforceflashlight-sales.com - member list accessible by public

triple_facepalm

mfpmax
mfpmax's picture
Offline
Last seen: 4 years 9 months ago
Joined: 09/26/2012 - 12:22
Posts: 377
Location: Florida

Guess it’s good I couldn’t buy direct from them, ended up buying from their Ebay store.

MRsDNF
MRsDNF's picture
Offline
Last seen: 2 months 1 week ago
Joined: 12/22/2011 - 21:18
Posts: 13473
Location: A light beam away from the missus in the land of Aus.

Message from SolarForce. It would appear that my name no longer comes up.

Dear friend,

Thanks for your email and nice to have a chance to serve you

Deeply apologize for any inconvenience caused and we have already fixed 
the problem immediately.

Thanks for notifying us about the problem of able to search your email 
and name in google search

WE have immediately contact the server Admin for the bug discover, and 
they have immediately fix it just now, you can check the link is not 
able to access now

After fixing the bug, you will not able to click the link and access 
the admin page

I show my deeply apologize there.

Furthermore, we have also email google to let them delete the search, I 
think they get back to us and action upon once they get our mail

WE do the best for all of you and sorry for any inconvenience caused.

Have a nice day and thanks for notifying us once you discover the bug, 
thank you from my bottom of my heart

Regards

Jo

 

djozz quotes, "it came with chinese lettering that is chinese to me".

                      "My man mousehole needs one too"

old4570 said "I'm not an expert , so don't suffer from any such technical restrictions".

Old-Lumens. Highly admired and cherished member of Budget Light Forum. 11.5.2011 - 20.12.16. RIP.

 

relic38
relic38's picture
Offline
Last seen: 3 years 2 months ago
Joined: 12/28/2012 - 00:39
Posts: 3390
Location: Toronto, Canada

Got the same message from them. Emailed them telling them to fix it and it looks like they did. Asking Google to fix/update the search was an extra step.

Someone made a mistake, and they quickly resolved it when informed. Good for them.
Will this stop me from shopping there? No, if they have something I want I’ll still get it.
It will make me reconsider putting my full name on any of these online sellers. Even considering revising all of my online accounts, but not sure I need to go that far yet.

Welcome the night.

My Reviews   My Mods    http://budgetlightforum.com/search?

Rod911
Offline
Last seen: 1 month 3 days ago
Joined: 08/25/2011 - 20:36
Posts: 456
Location: Melbourne

Like you said, they acknowledged the mistake and quickly fixed it. I haven’t bought anything there for a while, but I don’t see why I shouldn’t continue to do so. Their prices and customer service is pretty good.

As for my online information, I guess that is the price we all pay when we do shop online. We hope that these online stores have it in our best interest to make sure our information does not go to those who are not meant to get access to it. It just happens to be, things like this just happens.

Ejected Filament
Ejected Filament's picture
Offline
Last seen: 1 week 1 day ago
Joined: 12/03/2013 - 04:29
Posts: 2343
Location: Qld, Australia

Same email here too.

relic38 wrote:

It will make me reconsider putting my full name on any of these online sellers. Even considering revising all of my online accounts, but not sure I need to go that far yet.

Its always wise if you ask me. Even with CC companies and PayPal there is limited security so a website is bound to have less than ideal security. Any step you can take to minimise risk makes it harder. They dont need your full name anyway, Mr Whatever your last name is should be ample.

I will buy from them again, probably not too long from now, but it was pretty sloppy if you ask me. Especially when you consider the extra access Toykeeper and Helios managed without trying too hard, and without malicious intent.

ryansoh3
ryansoh3's picture
Offline
Last seen: 1 month 1 week ago
Joined: 08/04/2012 - 08:21
Posts: 3890
Location: US

Breaking news:

Solarforce has changed its sales policy to “pay what you want,” enabling anyone to choose how much to pay for their products.

BLF ≠ B-grade Flashlight Forum

 

locusto03
Offline
Last seen: 2 months 19 hours ago
Joined: 03/03/2014 - 01:35
Posts: 301

ToyKeeper
ToyKeeper's picture
Offline
Last seen: 11 hours 24 min ago
Joined: 01/12/2013 - 14:40
Posts: 10644
Location: (469219) 2016 HO3

Try to be nice… SF were probably deceived by a web design company which claimed to be more competent than they really are, and it’s probably going to cost quite a bit to find someone who knows what they’re doing and rebuild it correctly. Competent web developers aren’t cheap.

Boaz
Boaz's picture
Offline
Last seen: 2 hours 8 min ago
Joined: 11/07/2010 - 09:31
Posts: 7536
Location: Birthplace of Aviation

 

 

  Aircraft aluminum ..?

 

 I've always wondered ....Is that from old planes ?

       καὶ τὸ φῶς ἐν τῇ σκοτίᾳ φαίνει καὶ ἡ σκοτία αὐτὸ οὐ κατέλαβεν

                            

       Dc-fix diffuser film  >…  http://budgetlightforum.com/node/42208

Pages