Click here if you are having trouble logging into the forums
Privacy Policy |
Please read our Terms
of Service | Signup and
Troubleshooting FAQ | Problems? PM a Red or a Green Gu.... uh, User
~Steph~
Texas Wildflower
Reged: 06/11/05
Posts: 21658
Loc: North Texas
|
|
Quote:
Quote:
I hope we have volunteers lining up. After all, it would do no harm to have more than one account holder bring it to their attention. 
I'll take care of it. Everybody send me their account passwords and I'll log on using each of your accounts and inform them of the problem. Oh, and they might want your credit card numbers also for confirmation purposes, so you better send that to me also.
Better be quick about it, you don't want to get scammed, do you?
Good ol' HG, always trying to help out the community! 
--------------------
Steph
10" RCX400 ~~ 4" TV102 ~~ WO ZS80FD ~~ PST
Serenity Observatory 
HansenAstro | CN Member Websites
|
chug187
member
Reged: 09/18/06
Posts: 25
Loc: Bethesda, MD
|
|
Note that this is true for any website where you log in - the site has no way of knowing that you've left the building, gone to CNN.com, etc., so you're best off always logging out...
--------------------
Matt
=============================
6" Meade Starfinder, EQ Mount
12.5" Obsession
|
Island Mike
professor emeritus
Reged: 12/20/04
Posts: 522
Loc: Prince Edward Skyland, Canada
|
|
Wow,
Bad form on their end. I build web applications for a living, and I know exactly why this is happening.
This is a non technical explanation, so no flame on exact specifics please.
If you're on a site that needs to know who you are, e.g. e-commerce, forums like CN, you need to have some way to identify the user.
Once you've logged in, and as you move from page to page, the web site needs to pass information from one to the other in order for it to know who you are (for purchasing purposes, posting, etc.).
Otherwise, you would need to 're-login' every time you went from a page that didn't care who you are (eg. browsing productss) to one that did care who you are (e.g. your cart page).
One way of doing this is to pass this information (called variables) in the url. In other words, if I go to a page that needs my username I can pass my username along with a link like www.site.com/page.php?user=islandmike.
This sounds like what you experienced at the Orion site. Its passing your account info from page to page so when you arive at a page that needs it, the web application can pick it up from the URL.
On of the proper ways of doing this is to use Session Variables. These are stored on the server while you are on the site, and expire when you either log out, close your browser, or after a set period of time.
The good people here at CN use session varialbes.
Yes, always good advice to log out of a site once you are done.
Cheers,
Mike
--------------------
Antares 12 Dob
|
Island Mike
professor emeritus
Reged: 12/20/04
Posts: 522
Loc: Prince Edward Skyland, Canada
|
|
Hi,
This sounded too weird to be true. I just created an account with Orion, navigated through the site, and checked the URL every time.
While what I have described above is accurate, it DOES NOT appear to be the case with their site as far as I can tell.
Whomever found this, please let me know where about in the site this happended and I'll see if I can re-create the error.
As far as I can see, there site meets the basics for security. A moderator may wish to ensure we are not bad-mouthing Orion without cause.
Best,
Mike
--------------------
Antares 12 Dob
|
csa/montana
Astro Ambassador
Reged: 05/14/05
Posts: 28619
Loc: montana
|
|
Mike, this stemmed from a member that left a link to the Orion website re/product he had purchased. When anyone clicked on that link, it showed the OP's account information with Orion.
Carol
--------------------
Carol
AstroTech 16" Dob (Thanks ASTRONOMICS!)
AstroTech 66ED / Vixen 80MF/AstroTech Voyager
Masuyama's 7.5, 15, 25W, 35mm,
Tak LE 5mm B/TMB 3.2
7mm Pentax XL, 10mm Pentax XW
14mm Meade 4000 UWA
22mm Pan, 35mm Pan
DreamCatcher Dobservatory, #2
|
Island Mike
professor emeritus
Reged: 12/20/04
Posts: 522
Loc: Prince Edward Skyland, Canada
|
|
Thank you Carol. Very sloppy on their part; good to see this notic posted!
Cheers,
Mike
--------------------
Antares 12 Dob
|
csa/montana
Astro Ambassador
Reged: 05/14/05
Posts: 28619
Loc: montana
|
|
Thanks Mike!
Carol
--------------------
Carol
AstroTech 16" Dob (Thanks ASTRONOMICS!)
AstroTech 66ED / Vixen 80MF/AstroTech Voyager
Masuyama's 7.5, 15, 25W, 35mm,
Tak LE 5mm B/TMB 3.2
7mm Pentax XL, 10mm Pentax XW
14mm Meade 4000 UWA
22mm Pan, 35mm Pan
DreamCatcher Dobservatory, #2
|
panhard
Carpal Tunnel
Reged: 01/20/08
Posts: 2574
Loc: Markham Ont.
|
|
thanks for the warning.
--------------------
Orion xt10i
8 & 17mm Hyperion eye pieces
koning 32mm 25mm skywatcher eyepieces
lumicon 0111 & antares variable polarizing filters
12x50 binos
A love for this hobby
"What goes around comes around."
"She who must be obeyed."
Herb c
cloudy nights my # 1 site
43.53°n 79.17°w
|
karim
super member
Reged: 11/09/05
Posts: 129
Loc: HB, California
|
|
Wanna share with us what happened (without private information) and how you discovered it?
--------------------
http://www.eyepiecereviews.com
|
DwightX
member
Reged: 08/13/07
Posts: 60
Loc: Kentucky
|
|
Quote:
Wanna share with us what happened (without private information) and how you discovered it?
This is not a hoax, and hopefully Orion has fixed the issue. I'm not a computer person, but personally saw what happened before the post was deleted by a mod.
A member had purchased an Orion daily sale item. They referenced a direct link to the item so others could order. Apparently, the URL they posted contained their session ID (where they had not logged out).
When clicking on the link, the personal account information (address, phone, order history, last 4 credit card digits, etc) were just a click or two away. The previous order history on the right side of the page was what got my attention - and before reporting the siutation to a mod made me click on the "My Account" tab to check.
That's it in a nutshell. When you cite URL's from other websites, please be aware and careful.
|
csa/montana
Astro Ambassador
Reged: 05/14/05
Posts: 28619
Loc: montana
|
|
Quote:
Wanna share with us what happened (without private information) and how you discovered it?
DwightX's post explains exactly what happened. I read the thread & thought it wise to post the warning for others that were not aware of this glitch; just trying to help our membership!
Carol
--------------------
Carol
AstroTech 16" Dob (Thanks ASTRONOMICS!)
AstroTech 66ED / Vixen 80MF/AstroTech Voyager
Masuyama's 7.5, 15, 25W, 35mm,
Tak LE 5mm B/TMB 3.2
7mm Pentax XL, 10mm Pentax XW
14mm Meade 4000 UWA
22mm Pan, 35mm Pan
DreamCatcher Dobservatory, #2
|
jonw
member
Reged: 03/07/08
Posts: 46
Loc: Moab, UT
|
|
Unfortunately, this type of problem is fairly common. I thought I would post a link to a PDF that explains secure session management. http://www.sans.org/reading_room/whitepapers/webservers/1594.php The more you know...the safer your online purchasing will be.
--------------------
--Orion XT10i
Baader Hyperion-8mm,17mm,24mm,31mm Aspheric
|
Nightknight
member
Reged: 10/12/07
Posts: 74
Loc: The great pacific northwet of ...
|
|
OK, now that I've posted a couple links to Orion's site for some deals that people were looking for, how do I get rid of them? The time for editing the posts has passed-
--------------------
You can only talk astronomy with astronomers. Everybody else just yawns.
|
csa/montana
Astro Ambassador
Reged: 05/14/05
Posts: 28619
Loc: montana
|
|
As long as you didn't leave your acct to Orion logged in, when you posted the links, there's no worry.
Orion may very well have corrected this also, as many contacted them.
--------------------
Carol
AstroTech 16" Dob (Thanks ASTRONOMICS!)
AstroTech 66ED / Vixen 80MF/AstroTech Voyager
Masuyama's 7.5, 15, 25W, 35mm,
Tak LE 5mm B/TMB 3.2
7mm Pentax XL, 10mm Pentax XW
14mm Meade 4000 UWA
22mm Pan, 35mm Pan
DreamCatcher Dobservatory, #2
|
Starlighter
Carpal Tunnel
Reged: 08/03/07
Posts: 2561
|
|
Another reason I refuse to use the internet for purchases, banking, etc. If I cannot reach a business by phone, they don't get my business.
At my local bank, someone had their entire savings and checking account stolen via the web. And get this! The bank refused to cover the loss nor would the FDIC. This poor fellow was out just about every dime he had.
--------------------
Celestron C4-R 102mm achromat
Celestron Nexstar 6SE
Meade 80mm APO ED Triplet
Stellarvue SV102ED
Vixen A80Mf
Vixen A70Lf
CG4 mount
Vixen Porta Mount
|
j3ffr0
sage
Reged: 07/06/08
Posts: 234
Loc: Virginia
|
|
As long as your links don't contain the text sessionid, you are safe. Those sessionids should have a life span of no more than 30 minutes anyway. Unfortunately there are a lot of vulnerabilities and problems with custom web applications. Companies (both small and large) will not spend the money to test them properly and the developers can not do it themselves. If your develop a web application and get no one other than in house developers to test it, then you have vulnerabilities.... just like everyone else.
There is less risk in buying something from a reputable web site like amazon then there is using a credit card at a local restaurant. If you think about it, you give your credit card to a stranger who disappears with it for 5 minutes. They can write down all the information, and do with it as they please. There have even been instances of restaurant wait staff selling credit card numbers.
--------------------
10" Dob
127mm Mak
PST
35, 24 Panoptic; 16, 13, 9 Nagler
|
Bradley Miller
super member
Reged: 10/15/08
Posts: 120
Loc: Cincinnati Ohio Area
|
|
I have seen my mother do this very thing - pass information to me in an email "Hey son - look at this" (URL Follows) not realizing that the URL she copied and pasted contained information meant JUST for her. I have since warned her about this.
Brad
--------------------
Cincinnati Astronomical Society
1 of America's earliest established amateur astronomical societies
www.cinastro.org
|
lally
newbie
Reged: 10/20/08
Posts: 3
Loc: RU Moscow
|
|
Thank you 
|
|
6 registered and 7 anonymous users are browsing this forum.
Moderator: spaceydee, csa/montana
Print Thread
|
Forum Permissions
You cannot start new topics
You cannot reply to topics
HTML is disabled
UBBCode is enabled
|
Thread views: 8156
|
|
|
|
|
|
|
Previous
Index
Next
Threaded
[Re: 
Edit
Reply
Quote
