D&D 5E Hey Froggodgames, you remember how you secured your checkout last week?

[transtemporal]

After we pointed it out last week, you made changes to your site very quickly to secure your customers credit card information by changing the site protocol to https, providing a valid certificate for www.froggodgames.com and encrypting traffic with TLS 1.2. I got a blank screen when I went to buy the Book of Lost Spells last week so I thought I'd pop in this morning to buy it, with the following path:

http://www.froggodgames.com/ > (login) > http://www.froggodgames.com/necromancer-games > http://www.froggodgames.com/book-lost-spells (pdf format, 5th edition, add to cart) > http://www.froggodgames.com/cart (checkout) > http://www.froggodgames.com/cart/checkout

To my surprise, the checkout has reverted to being completely unencrypted and open again. So at some point this week, the changes you implemented were backed out. Can you please fix this and make sure it stays fixed this time?

 

[FormerlyHemlock]

I can confirm that hitting the "Review Order" button sends the credit card number over HTTP, not HTTPS, so it is vulnerable.

 

[mach1.9pants]

Send chris an email, PM'd his gmail address

 

[Charles Wright]

Yes, please contact us through the site. Posting here requires my finding it and passing it along to our support guy (Chris Haskins).

http://froggodgames.org/support

 

[Charles Wright]

All of our domain names now direct to https urls which means everything is encrypted.

 

[transtemporal]

All of our domain names now direct to https urls which means everything is encrypted.

Nice one, thanks. Did you find out what it was? I'm sure you don't want me sending gentle reminders every weekend, I'd certainly rather not.

 

[Queer Venger]

I use paypal

 

[GlobeOfDankness]

I use paypal

i will be doing this as well now if i ever order from them.

i once bought some stuff off a BMX site that had a reputation for laxy cyber security and someone in spain spent 500$ on my behalf because of it.

 

[Charles Wright]

Nice one, thanks. Did you find out what it was? I'm sure you don't want me sending gentle reminders every weekend, I'd certainly rather not.

I passed along the information I received. I'm really not the person who handles these things, just passing along the information.

I've been assured that this will fix the problem, but I agree that if you have an qualms or worries about this kind of thing to always use PayPal. That said, we don't mind people informing us of any problems because we want to keep our customers as safe as possible.

 

[Queer Venger]

It has happended to me, that is why if a site does not offer paypal, I wont shop there. Its not worth the hassle of having to call my bank because someone in Brazil is going on an online shopping spree with my card