Hunt Thread

[ajw]

I just looked back at my two posts from last night. I made the first at 7:17 pm EST (or EDT, I can never remember which is which). At 7:28 I made a similar post to the Collector's Universe board to alert that group of collectors. I then made a nearly identical post to a different Net54 forum at 7:51 pm. At 8:06 pm I posted a reply to that message, stating that I had called Hunt and told them about the problem.

I guess someone could argue that I should have called Hunt first, but the chronology above is how it went down.

ajw

[Leon]

Originally Posted by ajw

I just looked back at my two posts from last night. I made the first at 7:17 pm EST (or EDT, I can never remember which is which). At 7:28 I made a similar post to the Collector's Universe board to alert that group of collectors. I then made a nearly identical post to a different Net54 forum at 7:51 pm. At 8:06 pm I posted a reply to that message, stating that I had called Hunt and told them about the problem.

I guess someone could argue that I should have called Hunt first, but the chronology above is how it went down.

ajw

No worries AJW. No doubt you went above and beyond the call of duty on this one. I believe every word you said I was only relaying what I was told. Maybe Sonny did tell me you called but it was after the post....Regardless, the issue on their site probably should have been corrected by now. best regards

[autograf]

I'm no computer wiz either and tried to replicate the issue but couldn't. I was using an iPad and a Macbook. Maybe it's a fault with a certain browser? What browser were you using? I looked at the source code on the HTML and didn't see anything weird. The URL at the top didn't change when looking at the overall bids and when you clicked on an item, it gave you the item URL which changed from the huntauctions.com. I don't want details because ultimately I don't care but just wondering what browser you were using. I generally can figure out these type things and on a call with HRBAKER last night I couldn't.

[ajw]

Because someone asked, I was using Firefox. I also use the "No Script" add-on, so it's possible that blocking scripts somehow permitted me to see something I should not have. I highly doubt that's the case, though, as I am nearly certain that you could do the same thing using Internet Explorer.

I don't want to cause any more trouble, but I do think this is something that should be out there and discussed. To be honest, the information I saw would make it fairly easy to shill bidders. I have no idea if that happened, but that is the real risk here. With a minimal amount of computer skill, I suspect someone could have put together a list of every bid in the entire auction, along with the bidder's name and contact info.

I have had at least one person ask me how I was able to see what I did. I'm confident I did not do anything wrong, but I'm not really sure I should share the information. I don't know if Hunt fixed their site, but I'm not able to see the same information in the same way I did last night. Another poster above said he was able to just a few hours ago. Perhaps he's more tech savvy than I am.

Honestly, I think it might help if someone from Hunt showed up and made some sort of statement. I don't want to fan the flames any, but I also think that other bidders have a right to know what happened, why, and how Hunt is going to fix it.

I'm obviously not a regular here, but I do really respect the Net54 community. I'm not trying to cause trouble, so please let me know if I step over any lines I'm not aware of.

ajw

[Leon]

ajw- You did every thing correct. Last night the person I spoke with said they aren't really allowed to post on chat boards. I doubt they will come on here to explain it. best regards

[ajw]

Ok, given that the auction is over, I've had multiple requests for the information and the knowledge that Hunt is apparently fixing the problem, I'm going to pull back the curtain and show people what happened. Another reason I'm doing this now is because Hunt appears to have fixed the problem because I can no longer replicate what I was able to do on Wednesday night. If anyone disagrees, let me know.

A couple of weeks ago, I bookmarked the following URL because I could not figure out how to easily see the items I had bid on and their current status:

http://www.huntauctions.com/phone/re...bidder_id=####

The "####" at the end was my bidder ID. After bookmarking this, I could view the page from other computers and did not need to log into see my bid status. On Wednesday night, it finally dawned on me that it was very strange that I could see my information without logging in.

I looked at the URL and simply changed the #### to another number. Bam. There there was another bidder's name, address, email, phone and list of bids. The bids included not just their current bid, but also their max bid.

It didn't take too long to determine the highest bidder ID number and then work backwards. I'm not a computer guy, but I suspect your local high school has dozens of kids that could design a simple program to plug in all possible #### combinations and save the bid information. That would probably give you a full list of every bid made to that point. Obviously, that would not be a good thing.

Now that you see how easy it is, I am confident you will agree that it is unlikely that I am the first person to discover this flaw. I hope that no one used this to disadvantage other bidders. I further hope that Hunt will use this publicity as an opportunity to upgrade their website design. In fact, it was the lousy design that caused me to bookmark the page in the first place, thus leading me to my discovery.

Does this all make sense?

ajw

[glchen]

ajw, the issue is still not completely fixed yet. Please see the PM I sent you.