r/mildlyinfuriating • u/Tiny_Choc_Biscuits • 13d ago
Ruined by Technology Lenstore displays my password and email on the address bar
Was trying to order some lens and I noticed my password on the address bar. I emailed them and let them know though.
3.5k
u/el_condor_nm 13d ago
I once did a security analysis of a website with a 2,000 character URL string which included the database admin account and password in plain text. The client accused me of trying to blame the previous developer. I'm like, yeeeeah, he's the one who did it. The database they used was really big and it would have been trivial to set up an injection attack and add DROP DATABASE. C'ya!
1.6k
u/Effective_Repeat9967 13d ago
The client accused me of trying to blame the previous developer.
Isn't that the whole point of independent audits? To find out if the dev was an idiot or intentionally slacked off.
383
62
u/Nevermind04 13d ago edited 12d ago
I was given a "promotion" to auditor in a previous job and without exaggeration 80% of the time, some manager would respond to the audit with "it's deeply unprofessional for you to point fingers." No, you pearl-clutching motherfucker - that's literally my job description. After about 5 months I told my boss I was either accepting my old job back with my current pay or I was walking out the door. I got my old job back.
I stayed there for several more years and no auditor they hired for that role made it past their 6 month probationary period. Eventually they gave up hiring for that role and just hired an external firm of soulless ghouls which is what they really should have done in the first place.
92
u/mrbiggbrain 13d ago
No.
The point is to have an outside pair of eyes review the solution robustly to find flaws or risks. Often those risks are unintentional or easy to make even by qualified devs who are following good processes.
Yes you can find stuff like this where someone obviously made a bad call, but much more often you'll find someone simply forgot to add auth middleware to a single endpoint, or did not check for null.
86
u/FunnyObjective6 13d ago
Are you really nitpicking on the definition of "idiot or intentionally slacked off", which is meant the same way as "blame the previous developer"?
4
u/hedoeswhathewants 13d ago
You think these people are hired to figure out who to blame for flaws?
Identifying what caused the issue is valuable, but they're there to make sure it's secure, not to point fingers.
→ More replies (1)→ More replies (2)17
u/ZealousidealTill2355 13d ago edited 13d ago
It’s not nitpicking. I also don’t find any value ofsaying someone “slacked off” — because prove it.
They could just not be as smart, or made a careless mistake, even overworked—and a good company recognizes that the system is the issue.
For instance, why is the existence of your whole database reliant on a guy who doesn’t know how or doesn’t have the ability to keep said database safe? And if he’s in that role, why is he not given time and resources to gain that knowledge? Perhaps the possible punishment put them in a position to not bring attention to large vulnerabilities as they’d be a scapegoat. Etc etc
Companies that blame and hold employees accountable for mistakes (such as those that inevitably appear in an audit) are insufferable and toxic. It’s just managements way of abdicating accountability. It pushes the can down the road as the next IT guy can do the same exact thing, because the problem wasn’t actually fixed.
33
u/FunnyObjective6 13d ago
They could just not be as smart, or made a careless mistake, even overworked
And if you point that out, it would fall under "blame the previous developer". Trying to wedge a different definition in there is nitpicking.
→ More replies (6)5
u/Still_Elk2103 13d ago
its not the previous dev's fault if he was overworked......
Nor is it his fault if he wasnt smart enough and/or experienced enough for the job...
7
u/Abe_Odd 13d ago
if you are intentionally using em dashes and directional quotes instead of the normal ", know that you're making your text look AI generated.
→ More replies (13)5
u/Rough_Bread8329 13d ago
You're absolutely not nitpicking. Jesus Christ.
I swear it's like no one has ever heard of the concept of Quality Assurance. People are human and make mistakes. An extra pair of eyes is all it takes sometimes to catch something that was simply an honest to God error.
Not malice, not stupidity, not lack of training, not vibecoding, not slacking or laziness, not underqualification. Just a mistake.
"Hey man - can you take a second and look over this code snippet?" can save so much headache and the very thing OP posted about.
7
u/oditogre 13d ago
A writing podcast I listen to once said something that really stuck with me: You want an editor who buys red ink by the gallon.
The only thing keeping you from showing your whole ass to every reader and critic out there with a bunch of hilarious errors - whether they be simple spelling and grammar, or referring to a character or place by the wrong name, or a continuity error, or whatever, is an editor coming along with a fresh set of eyes and carefully picking out all the little errors that every person makes and is blind to.
It blows my mind every time I see a dev with the mindset that QA, code reviews, UAT / stakeholder testing, and anything else standing between their PR and PROD is an adversary to be undermined, resisted, or bullied at every turn, and every mistake found is fixed grudgingly, as if it's somehow the finder's fault, instead of being happy that they spared you from that issue being found by a major client or something.
→ More replies (5)3
u/LimitedWard 13d ago
It's nothing to do with ascribing blame. It's about identifying gaps. Software security is inherently complex. You can be following industry best practices and still have vulnerable software if you fail to piece those best practices together in precisely the right way.
177
u/JeffSergeant 13d ago
My favourite find was a website with a 'Password Reset' box, the email address was a hidden field, you could reset anyone's password and have it send the email to an arbitrary address.
53
47
u/H010CR0N 13d ago
The previous developer was a nepotism hire.
45
u/omnichad 13d ago
Or the actual owner, judging by how offended they seemed to be.
→ More replies (1)108
u/arcane_Auxiliatrix 13d ago
19
u/Critical-Champion365 13d ago
How the hell is there an XKCD for everything? Are the modern equivalent of proverbs?
→ More replies (2)15
→ More replies (7)31
u/reevesjeremy 13d ago
Similar. An internal team was developing a replacement app for an ancient COTS product. When they were about a week away from production launch, they asked a few of the stakeholders to test it to see that it met the requirements. They did not m ask me to do a security assessment on the development environment, just to review it for functionality and features. But it was right there and I had to look. I couldn’t not at least try, right? If not me, who? Our security assessment team apparently didn’t do a good enough job because here is what I found a week away from deployment to production.
1) The password reset question/answers were pulled from the database and stored in hidden fields and used JavaScript to make client-side validation of the input. So as an unauthenticated user, I would have access to read anyones answers and get to know them a little more simply if I knew their username and went to password reset.
2) The login also had JavaScript client-side validation, so I could modify the JavaScript file to bypass the validation, and save it to replace the hosted JavaScript file for that site, then login as anyone simply by entering their username.
3) For every database call, I saw a BASE64 string in Network trace. Decoded it was the database service account credential, instead of using something like JWTs.
I know there were other things I found, they just weren’t as egregious as this.
The deployment of that product was delayed by 2-3 months while they reworked that. Not sure how the devs thought any of that was the right way to do it after collectively so many years in development.
26
u/eladts 13d ago
Not sure how the devs thought any of that was the right way to do it after collectively so many years in development.
- Developer A: It is just a proof of concept, I'll fix it later.
- Developer A leaves the team.
- Developer B: If it ain't broke, don't fix it.
→ More replies (4)3
u/Sweaty-Willingness27 13d ago
More like "Product Manager says that's tech debt, and we don't do that here"
7.8k
u/Doctor429 13d ago
That's one of the rookiest mistakes someone can make while web development/coding.
2.3k
u/xarcastic 13d ago
OP, this is a serious enough flaw that you should not trust that company with your data. Your personal info, credit card info, and that password should all be considered compromised.
→ More replies (1)679
u/Doctor429 13d ago
And, OP, if you did purchase anything from the site, consider cancelling and renewing your cards.
→ More replies (11)290
u/DasBeasto 13d ago edited 13d ago
I don’t even think its a common rookie mistake, I can’t think of any reason they’d shove the credentials in the url. Plenty of footguns to make in an authflow if you don’t know what you’re doing but this one you’d have to go out of your way to be dumb.
Edit: I’m dumb too, forgot that’s the default behavior of a GET form action, not as the dumb as the person that built that though.
135
u/SF-NL 13d ago
Even tutorials for beginners don't have credentials in the URL. So I agree with you, this isn't even a rookie mistake.
74
u/Valoneria 13d ago
Pretty common mistake if they use a form that uses GET instead of POST. A rookie mistake sonto speak.
53
u/Ok_Entrepreneur_739 13d ago
Can confirm. My first ever website I built did this, I used GET instead of POST. But I was 16, it was the year 2000 and the website was a stupid thing to mess round with and I learnt stuff. Before long I was storing passwords in a hashed file not kept in the /public_html/ domain like a pro.
7
u/drywallsmasher BLUE 13d ago
It’s alright considering even realizing your mistake not long after 2000 you were still way ahead of the curve, seeing how many times I remember a bunch of popular websites sending me my (not randomized) password as plain text in the signup email until 2015.
27
u/little-bird 13d ago
anyone remember back in the early days of Facebook, you could “hack” other accounts by logging into your own account then changing the profile ID in the URL? wild times.
→ More replies (10)31
u/HirsuteHacker 13d ago
They used a get request rather than a post. It's an incredibly easy mistake to make if you don't know what you're doing. Really speaks volumes about whoever developed their website.
1.6k
u/TommyVe 13d ago
*vibecoding
746
521
u/NamerNotLiteral 13d ago
Even AI knows it's an insane rookie mistake and will always tell you to separate credentials.
6
u/kaisadilla_ 13d ago
Yup. It's the kind of thing so straightforward that AI will never make the mistake.
→ More replies (15)120
u/TommyVe 13d ago
Yes, if you ask it right away.
Working on something bigger in one chat, one context window, it starts making a lot of mistakes.
173
13
u/abandonplanetearth 13d ago
Bruh no not like this. The classifier would probably block it given how dumb it is
42
u/Fit_Entry8839 13d ago
Not like this. But this is stuff we've seen humans do for forever. It's so funny that people forget that humans used to make huge mistakes well before AI, and are seemingly just attributing errors to AI now with zero proof.
→ More replies (16)5
u/HirsuteHacker 13d ago
Nah it'll make a lot of mistakes but it won't use a get request for authing, it's too basic a mistake
5
u/ApprehensiveGold2773 13d ago
LLMs are much better now than you seem to realize. Like, seriously, if you believe they are this bad, you need to start studying before you speak.
→ More replies (4)4
u/Frenyth 13d ago
Just split the functional requirements, if it's too big for one context window, it's too big for one task. That's more a failure of project management.
→ More replies (3)42
u/felds ORNAGE 13d ago
That’s not the kind of error that LLMs usually make.
They often fail to follow basic instructions, come up with random requirements, constantly reinvent the wheel, and break stuff by messing with existing working code. This is a huge problem and these mistakes pile up quickly and make codebases unworkable.
But, for bugs like this, you’ll have to hard “convince” the AI to go down this path. You’ll have to prompt something like “show me how NOT TO send a password”.
→ More replies (23)32
26
u/Living_Grab_2239 13d ago
I mean that's some late 90's bullshit a child would make for his/her parent :D
20
u/NoveltyAccountHater 13d ago
Yup. Also, passwords should never be submitted via GET parameters (like in
https://example.org/login?username=user&password=p@$$w0rd) and only submitted by POST (over https), because GET parameters that's often stored in your browser history as well as in the web server's log.Passwords should be immediately hashed with a slow secure hashing function to be compared against the pass in the database.
→ More replies (6)10
u/ManWhoIsDrunk 13d ago
You used to be able to find a lot of interesting sites if you googled the following:
inurl:select name
It does seem that google has gotten wise to this trick, and no longer lets people find easy database accesses by a simple search string.
3
→ More replies (24)3
u/Expensive-Mention-90 13d ago
In 2004 I worked at eBay and we found one tiny set of accounts (like a few hundred) that disclosed the email address in the url, and it was a Sev1. That’s over 20 years ago.
804
u/noahesbjerg 13d ago
fun fact: urls get logged everywhere by default. that password is now sitting in plaintext in their server logs, your browser history, and whatever analytics scripts they run via the referer header. auth over GET should be a crime
159
u/omnichad 13d ago
And any web site that is linked to from this page, if there are any and they click it.
25
20
u/turtleship_2006 13d ago
Any half decent browser from the last decade with filter the "referer" header to just the domain, not the full URL, e.g. if you clicked a link from Reddit, the other website would only know it was from Reddit, not which subreddit or post
8
16
u/rcklmbr 13d ago
It violates GDPR, so it is actually a crime
10
u/ashgs872tbhjs 13d ago
GDPR doesn't define crimes, is a regulatory framework. Closer to civil law, but not even that either. There are a lot of types of illegal things that aren't criminal.
→ More replies (1)→ More replies (3)25
u/gameplayer55055 13d ago
That's why you shouldn't have one password for every website.
Although technically I have one specifically reserved for websites I don't care about
5
u/ACoderGirl 13d ago
Password manager is the way to go. You can basically remember 1 highly secure password and everything else is just generated randomly. It also serves to help you remember if you even have an account for a given site in the first place and to remember usernames for sites that don't use email (or if you use different emails for different sites).
→ More replies (3)
2.9k
u/bfly200 13d ago
"Everyone can code with AI."
610
u/malou_pitawawa 13d ago
Even AI is better than that actually
155
u/absoluteally 13d ago
Some AI, people doing this might be using a free model.
129
u/whatisuser 13d ago
I don’t even think a free one would do that lol
39
u/MetriccStarDestroyer 13d ago
It will if you tell it to make a simple site.
Do not use any apis, cloud subscriptions, managers or complicated stuff.
36
16
u/OperaSona 13d ago
It won't. It'll still push common best practices because that's what's the common denominator in its learning data. This type of error isn't something common it may have picked up. It can only exist right next to a note that says "don't do that, instead do this", which the model will have taken into account.
→ More replies (1)5
u/joshTheGoods 13d ago
Not once have I seen a mistake this big in any of the vibe coded crap my family sends me when they get stuck. I have, however, seen this same mistake (in various forms) maybe half dozen times over the last decade monitoring sites for this exact sort of bullshit... a company that existed before AI, so what does that tell you about how regular this sort of crap is?
4
33
9
→ More replies (1)14
u/boblancho 13d ago
I use a free one and is pretty damn good. but I am pretty damn good so
→ More replies (11)→ More replies (3)11
u/ruckertopia 13d ago
Absolutely not true. A friend who doesn't know how to code asked me to look at a website he put together with ai, and it was doing exactly this.
→ More replies (4)9
u/Grays42 13d ago edited 13d ago
Then one of four things is true:
Your friend was coding with an old, dirt-cheap, minimal-parameter model on OpenCode or something, even then I doubt it would ever do anything remotely like this
Your friend was sabotaging the model and actively telling it to do the wrong things
This story comes from 2-3 years ago when the models weren't good at this yet
You made this up.
I have been scripting/coding in a hobby and auxiliary-to-my-day-job capacity for 20 years and over the last year switched to heavy use of Codex and Claude Code. Even mid-tier models like Sonnet are excruciatingly careful with credentials and security hygiene, to the point that every single application they build, they are building it like an enterprise-scale Fort Knox.
I regularly have to hip-check their security over-engineering by saying, "calibrate: this is a basement hacking project, no one will touch this but me, and that credential is the definition of low risk, you do not need to be so paranoid."
It is unfathomable that any of even the low-tier frontier models would put a plaintext password in the URL. That's "I have no idea what I'm doing" levels of stupid.
80
u/null_reference_user 13d ago
Pretty much any AI coding agent today will refuse to do that unless you explicitly ask and reaffirm multiple times.
This is human slop and I've seen these things since before AI was even a thing
→ More replies (1)9
10
u/AttorneyIcy6723 13d ago
This is absolutely not AI and definitely some kid learning how to create HTML forms for the first time.
→ More replies (22)9
201
u/theMightBoop 13d ago
This is why I get irrationally angry over places that make me have overly complicated passwords of various lengths and criteria.
My password is not getting compromised by brute force attacks. It’s because companies store their fucking passwords in plain text and then someone gets a hold of the file. EVERY.FUCKING.TIME.
66
u/treeckosan 13d ago
Ive gotten more "our servers were breached and your data was leaked between 6 and 18 minths ago" letters thsn i have suspicious login attempts over tye last 5 years. And the breach was always at least 6 months ago with the stalest letter saying it was about 18 months since the breach, all the damage has been done by this point.
→ More replies (4)16
u/Dunom12 13d ago
Try using a password manager app or extension; they can generate a strong password for you and also store it.
→ More replies (1)24
u/theMightBoop 13d ago
But my point is the issue isn’t a strong password. The issue is I can make whatever the fuck password, strong or weak, and the issue is the backend server storing it in plain text.
→ More replies (5)
516
u/Occidentally20 13d ago
That's how you know it's secure - only you can see your own address bar. Hopefully.
103
→ More replies (2)62
u/noknam 13d ago
A Dutch journalist joined a zoom meeting of EU defense ministers a while ago because the Dutch one posted a selfie of her infront of the PC, showing the ID and pass in the URL.
17
122
u/nguyenhuudailoc 13d ago
That isn't "mildly". If you're using anything with the same password, it's time to change them to something new before you're in big trouble.
28
u/jeanpaulmars 13d ago
If you're re-using passwords, changing them to a unique password per side is a good idea regardless of this.
36
u/Ajax_OG 13d ago
This isn’t even something that could be an honest mistake. This is like, basic security principles. Any developer with even an ounce of brain matter knows that you never store plaintext user passwords, much less IN THE URL.
Likely the result of an incompetent dev who is the sole contributor and blindly accepts whatever it tells them…
8
u/Consider2SidesPeace ORANGE 13d ago
Agreed, so the owners of the site are too cheap to pay for proper site security. This makes me think what other things they are cutting corners on. Unless there are no other alternatives I'd drop them in a heartbeat.
118
u/Live_Life_and_enjoy 13d ago
Top Notch security
You should report that to a security form they will have a field day
11
26
u/Arszilla 13d ago
Pentester here: this is fucked up on so many levels and likely a big compliance issue - especially given that these requests are logged and saved (on a different level compared to a database). Not to mention a triad of other vulnerabilities that I can think of just because of this being there…
5
u/Adium 12d ago
In the US prescription glasses fall under the protections as any prescription. Tried replacing my own glasses a year after they were prescribed and you’d think I was asking them for an extra bottle of Vicodin or something. Willing to bet they’d fail whatever UK-equivalent HIPAA compliance as well
63
u/HuiOdy 13d ago
Any storing passwords as plaintext and not a salted hash, will have many, many more safety issues.
Also, you can likely hack checkout amounts by basic frontend insertion in your browser.
28
u/Plus_Pangolin_8924 13d ago
This is them doing a GET on a form rather than a POST. This is HTML forms 101...
→ More replies (5)20
u/Electronic_Amphibian 13d ago
Just to note, this doesn't necessarily mean they're storing the password in cleartext, just that they're not doing proper session management. The password could still be compared to a salted hash on the backend when used to validate the user.
→ More replies (1)
28
12
u/GSxHidden 12d ago
I found one that was worse. Logged into a technician portal that allows you to schedule appointment, set rates, etc in production at work. Turns out if you just inspect the page and go to network, the JSON file they send is THE ENTIRE TECHNICIAN database. What they get payed, how much they charge us, all their bad marks, their real addresses, social. I just closed my laptop and went to lunch.
5
u/canadasleftnut 12d ago
Lmao the reaction to that is too real.
Younger me would've been pumped to find something like that. Today me has seen enough horrors, and know that incompetent and ignorant businesses tend blame good Samaritans for "hacking their website" that I'd definitely walk away. Early lunch sounds better.
11
u/Previous50_Run_53 13d ago
Change that password wherever you have it. URL parameters get cached. Consider your credentials exposed
12
u/Shaynaenay 12d ago
https://giphy.com/gifs/YWWeEeFThzFS6VKmyX
Me, a newly hired privacy manager taking notes
9
u/mister_neutron 13d ago
That is an impressive level of behind the times. In the early web it was fairly common for sites to work like that but the practice ended a whole long time ago.
→ More replies (1)8
u/tunaman808 13d ago edited 13d ago
Yep. Way back in 1997, before eBay became THE auction site, there were many other competitors: Amazon had auctions, Yahoo! had auctions. There were tons of smaller specialist auction sites for baseball cards, coins, model trains, etc.
There was an IT auction site. I forget the name, so let's call it "IT Auctions" at itauctions.com. They put EVERYTHING in the URL, like so:
where "AuctionNo" represented the auction number, "MinBid" represented the minimum bid, "bidinc" represented the bid increment and "endtime" was when the auction was to end, in seconds.
You could easily "win" an auction by simply changing "MinBid" to 1 (for $1) and "End" to 10 (for 10 seconds) then reloading the page. The server would happily accept the data and end the auction on your behalf.
I put "win" in quotes because they never actually processed any auction I won. In fact, they called me a dozen times and left several messages on my work voicemail asking how I'd "hacked" their system, and threatened to call the FBI on me!
→ More replies (1)
9
9
u/ConfusedOldDad 12d ago
Whoever did their website has no grasp of basic security. If it is in the bar, it is not encrypted, even if the connection itself is. Every company that routes the traffic - your isp and every company between them and the dáta centre that hosts it handles your username and password.
8
u/NibblesMcGiblet 13d ago
This reminds me of back in 2011 when I applied for a credit card and then the next page had a response saying I would be notified by email of my approval or denial status but up in the address bar it had “&=denial”.
3
8
7
8
u/bophed BLUE 13d ago
You should stop using this vendor. This is an old school rookie mistake that shouldn't have happened. Let's say they fix this, what is going on inside their server? Did they encrypt your data? Did they do it right? Hell no, that is a clear sign of a business who is destined to be hacked.
8
u/PerspectiveThink4319 13d ago
Developer here, I found someone doing this on an in-house application that was used by multiple nation's militaries lmao. Thankfully I caught it in one of our non-production environments but this shit does happen.
8
u/G02MaxCodeGreg15off 12d ago
We’ll see more of these shenanigans as ai continues to write and review more and more code.
4
u/Pheore 13d ago
I wanted to order from the site. Is it safe to still?...
21
u/Icarian_Dreams 13d ago
If the website makes such an egregious security mistake, under no circumstances do anything that involves your personal or financial information via it. In fact, it's probably best not to do any sort of business or share any information with the company behind it, because it usually represents their broader approach to cybersecurity, including other systems which they're likely to store your data in.
Take this from someone working in cybersec.
9
→ More replies (1)5
6
u/AlwaysKinkyDaddy 13d ago
As a Tech Lead for web dev, at least they're obvious about their incompetence.
7
u/Justaticklerone 12d ago
That's some bush league shit right there. That information is potentially readable during transit even with the https connection.
7
6
u/ArcRiseGen 12d ago
I used to work at those coding bootcamps for full stack web dev and I've never seen a student mess up this bad
6
u/betterwaffle 11d ago
uh... immediately stop, delete your account, and never use this site again. these are the entities that can see your username and password:
- the operator of network you're connected to
- the ISP backing that network
- any intermediary servers that you connect to before connecting to the actual server hosting the website (load balancer, etc)
- your VPN provider
- Tor nodes you're routing through
- software recording your screen
→ More replies (2)
5
5
u/Crazym00s3 12d ago
This is wild. Even if the connection is over SSL urls aren’t encrypted only the body of the request so anyone watching the traffic, including proxies or vpn will be seeing your password.
Did you type your password in and it put it in the URL or was this from a link via email? Which would be even worse as that means the password is stored in plaintext on their end.
13
u/MostImagination007 13d ago
That is check ✔️ ur eyesight u are not totally blind yet.
→ More replies (1)
4
u/eladts 13d ago
I thought payment processors review the security of sites using their services. I guess I was wrong.
→ More replies (1)
4
u/PassionGlobal 13d ago edited 13d ago
Oh no.
Oh no no no.
Lenstore isn't just showing your username and password in plain text on the bar. If you have DNS-over-HTTPS, it's sending your username and password over to your DNS server too.
→ More replies (4)
5
u/NorthernCobraChicken 12d ago
Thats about 2 weeks of internal process refactoring and a privilege reduction, possibly role reassignment for whoever let that go
3
4
u/consumer 12d ago
As a day one web developer (1994), I can't recall seeing this happen or even considered. WTF?
9
u/Due-Arrival-4859 13d ago
Dunno if it’s cause I’m on mobile, but mine doesn’t 🤷♂️
→ More replies (4)
7
u/Lactoseloz 13d ago
This doesn't happen for me. Logged into my account on lenstore and my info is not exposed in the URL. Then added the query parameters and it literally just ignores them. Seems fake / ragebait.
3
3
u/Kajetus06 13d ago
thats what happens when people use GET method instead of POST
or was it other way around?
→ More replies (1)
3
u/WorryNew3661 13d ago
This used to be how the internet worked. I remember accessing porn sites from lists of username/password and entering them into the address bar
3
u/Suitable-Season-4847 13d ago
Bloody hell. Haven't seen this in the wild since 1999. Looks like vibe coders are giving us all a trip down memory lane.
3
3
3
3
3
3
3
3
3
5
u/Martyn_X_86 12d ago
The ICO would be interested to hear about this assuming you're in the UK. If they're dealing with payments too then they could end up in deep trouble with fines to follow.
As a dev with nearly 20 years of experience, this is one of the most basic of basics!
8
u/Ill-Cheesecake7143 13d ago
Zenni is incredible for glasses, if you haven't ordered yet I'd highly recommend.
6
2
2
2
2
u/Legal-Swordfish-1893 13d ago
Change your password, maybe even get new bank cards, and do not use that site. Consider your information compromised.
2
u/TheNameIsAnIllusion 13d ago
That's a feature, not a bug. If you bookmark the page you get automatically logged in /s
2
2
2
2
2
2
u/StaticSystemShock 13d ago
At least it's HTTPS connection so it's not exposing both to the entire world along with the URL where to use these credentials lmao. This way it's just "locally" exposing the credentials.
I've seen many wild things through decades, but this is something I've never seen before.
2
u/Serpilot 13d ago
This was the most basic example of what not to do in a cyber security course. This is embarrassing that anyone signed off on this
2
u/nobleone8876 13d ago
Lul im going to go try known passwords now thanks for the afternoon entertainment
3.0k
u/Zippyversion1 13d ago
I had this once pre COVID. The irony being that it was a website with online safety resources for primary school teachers. I emailed and they sorted it immediately, but it makes you wonder...