Reply to thread

Message

<blockquote data-quote="Festivus" data-source="post: 5380447" data-attributes="member: 34532">I really just have a couple major concerns about security with the site, simple things they could do to build my confidence.&nbsp; The performance and bugs will be worked otu in time, yes.&nbsp; However, I pointed these out and have yet to hear of any action or plan of action for them:* Wrap sessions in SSL and use encrypted cookies - Right now, you use the same user name and password to set up your credit card information as you do to log into DDI.&nbsp; DDI isn't a secure site, there is no padlock.&nbsp; This is something they *should* be able to fix with relative ease, but have not yet done so (it's been this way since launch... really silly)* Don't divulge critical internal workings of code when an error occurs is another.&nbsp; That should also be easy to fix, it's a setting on the server.&nbsp; I have seen enough crash dumps to be able to tell you where they store the databases on their servers, what kind of database and web server they are using, and a few other juicy details (like the field name for the login name).I am waiting for the letter to arrive in my mailbox when they have a breach... because it's going to happen sooner rather than later with them.</blockquote>

[QUOTE="Festivus, post: 5380447, member: 34532"] I really just have a couple major concerns about security with the site, simple things they could do to build my confidence. The performance and bugs will be worked otu in time, yes. However, I pointed these out and have yet to hear of any action or plan of action for them: * Wrap sessions in SSL and use encrypted cookies - Right now, you use the same user name and password to set up your credit card information as you do to log into DDI. DDI isn't a secure site, there is no padlock. This is something they *should* be able to fix with relative ease, but have not yet done so (it's been this way since launch... really silly) * Don't divulge critical internal workings of code when an error occurs is another. That should also be easy to fix, it's a setting on the server. I have seen enough crash dumps to be able to tell you where they store the databases on their servers, what kind of database and web server they are using, and a few other juicy details (like the field name for the login name). I am waiting for the letter to arrive in my mailbox when they have a breach... because it's going to happen sooner rather than later with them. [/QUOTE]

Verification