Security Breech from Bill Goodwin- UPDATE IN POST #77

[NATCARD]

I use Simple Auction Site for my auctions. I can see all of my customers User id's and passwords. If they were to call and ask for their password I can give it to them. It also has the ability to send a reset password email which is much safer. Thanks, Jeff W (National Card Investors)

[sb1]

Odd.... then it must be an option for the administrator. I certainly can't see that.

[Aquarian Sports Cards]

It's a big problem for an auction to have access to user passwords. It really is carte blanche to do whatever they want. Not saying that any particular company would do something unethical, but the opportunity should not be there.

[Sean]

I don't know whether to be insulted or grateful that I didn't get an email from Bill.

[Leon]

Originally Posted by sb1

Odd.... then it must be an option for the administrator. I certainly can't see that.

I believe it was/is an option. I am sure we, when we ran the auctions together, chose the option to not see anyone's passwords or up to bids. My guess is that followed you to your new company.

[Phil68]

Is it possible it was a simple mistake by Bill or his administrator?
I got the email and was stupid enough to think "cool, my login hasn't changed" as I am a regular Goodwin participant. After reading this thread, I can see how foolish I was.
I'd like to think Bill is a solid dude. Maybe it was an honest mistake--albeit a rather large one?

[swarmee]

This would definitely be good information for the FBI (as it pertains to possible likelihood of shilling) and the Cyber Security feds to have. Shouldn't everyone involved in this be notified and given the option for oversight of their online accounts from the various credit tracking agencies?
I would recommend that you who have been notified by email forward it to the proper authorities.

[prestigecollectibles]

We use createauction.com, the same platform used by REA, Memory Lane, Lelands and others. We can't see user passwords or autobids.

[Phil68]

Originally Posted by swarmee

This would definitely be good information for the FBI (as it pertains to possible likelihood of shilling) and the Cyber Security feds to have. Shouldn't everyone involved in this be notified and given the option for oversight of their online accounts from the various credit tracking agencies?
I would recommend that you who have been notified by email forward it to the proper authorities.

John,
They have it.

[bcornell]

Originally Posted by NATCARD

I use Simple Auction Site for my auctions. I can see all of my customers User id's and passwords. Thanks, Jeff W (National Card Investors)

Thanks for confirming this, Jeff.

It is completely unacceptable for the SimpleAuctionSite and Barnebys.com (their parent company) to allow passwords to be stored in clear text and to allow auction site owners to optionally see them. It's not an oversight or "not a big deal". This is a complicit, lazy, unacceptable breach of data security.

The list of sports auctions sites using their software is long. You can easily check this by looking at the footer of any page on a site. If it shows the SimplyAuctionSite logo, you can assume that your username and password are NOT private.

If the excuse is "it wasn't malicious", then the answer is that it's incompetence. They can choose. Bob Freedman and SimplyAuctionSite, get this fixed tomorrow.

[doug.goodman]

Originally Posted by bcornell

Thanks for confirming this, Jeff.

It is completely unacceptable for the SimpleAuctionSite and Barnebys.com (their parent company) to allow passwords to be stored in clear text and to allow auction site owners to optionally see them. It's not an oversight or "not a big deal". This is a complicit, lazy, unacceptable breach of data security.

The list of sports auctions sites using their software is long. You can easily check this by looking at the footer of any page on a site. If it shows the SimplyAuctionSite logo, you can assume that your username and password are NOT private.

If the excuse is "it wasn't malicious", then the answer is that it's incompetence. They can choose. Bob Freedman and SimplyAuctionSite, get this fixed tomorrow.

I agree.

[RedsFan1941]

i am not expecting either bill Goodwin or bob freedman to come on the board and explain anything.

[bcornell]

Originally Posted by RedsFan1941

i am not expecting either bill Goodwin or bob freedman to come on the board and explain anything.

Nope, Ronnie, they won't. That's why I contacted both directly, as well as Barnebys.com, the Swedish outfit that bought SimpleAuctionSite to let them know what they did wrong, why it's wrong, and how they have to fix it immediately.

I realize you think you're smarter than everyone else. That comes through in all your snarky, know-it-all posts. Some of them are even funny, although mostly they're just predictable and boring. Who are you, anyway?