Security Breech from Bill Goodwin- UPDATE IN POST #77

[conor912]

Piss poor form by Goodwin. The subject line “your username and password” almost makes it comical, it’s that stupid.

[mechanicalman]

When I saw an email address "bill@___," I thought, shoot, what I am getting a bill for?

[daves_resale_shop]

does anyone have a screenshot of the email. May be a spoof attempt to compromise the recipient, and not necessarily a data leak from goodwin... i’d be very careful in investigating the situation prior to ruling it a breach.

David linardy

[buymycards]

Originally Posted by daves_resale_shop

does anyone have a screenshot of the email. May be a spoof attempt to compromise the recipient, and not necessarily a data leak from goodwin... i’d be very careful in investigating the situation prior to ruling it a breach.

David linardy

Username and Password
Inbox
x

bill@go-heartland.com
8:15 AM (8 hours ago)
to me

Welcome to Bill Goodwin's Heartland Sports Auctions

Our first auction starts tomorrow, Saturday March 21 and ends Thursday April 9.

Here are your credentials to log in to your account along with a link for the Go-Heartland site.

Username: deleted
Password: deleted
Link: https://go-heartland.com/

Feel free to update any information such as your address, or update your username and/or password if you would like.

Thank you,

Bill Goodwin
Heartland Auctions
314-849-9798
Go-Heartland.com

[daves_resale_shop]

Originally Posted by buymycards

Username and Password
Inbox
x

bill@go-heartland.com
8:15 AM (8 hours ago)
to me

Welcome to Bill Goodwin's Heartland Sports Auctions

Our first auction starts tomorrow, Saturday March 21 and ends Thursday April 9.

Here are your credentials to log in to your account along with a link for the Go-Heartland site.

Username: deleted
Password: deleted
Link: https://go-heartland.com/

Feel free to update any information such as your address, or update your username and/or password if you would like.

Thank you,

Bill Goodwin
Heartland Auctions
314-849-9798
Go-Heartland.com

Thanks for that Rick,

Now I follow.

[NATCARD]

I use Simple Auction Site for my auctions. I can see all of my customers User id's and passwords. If they were to call and ask for their password I can give it to them. It also has the ability to send a reset password email which is much safer. Thanks, Jeff W (National Card Investors)

[sb1]

Odd.... then it must be an option for the administrator. I certainly can't see that.

[bcornell]

Originally Posted by NATCARD

I use Simple Auction Site for my auctions. I can see all of my customers User id's and passwords. Thanks, Jeff W (National Card Investors)

Thanks for confirming this, Jeff.

It is completely unacceptable for the SimpleAuctionSite and Barnebys.com (their parent company) to allow passwords to be stored in clear text and to allow auction site owners to optionally see them. It's not an oversight or "not a big deal". This is a complicit, lazy, unacceptable breach of data security.

The list of sports auctions sites using their software is long. You can easily check this by looking at the footer of any page on a site. If it shows the SimplyAuctionSite logo, you can assume that your username and password are NOT private.

If the excuse is "it wasn't malicious", then the answer is that it's incompetence. They can choose. Bob Freedman and SimplyAuctionSite, get this fixed tomorrow.