Security Breech from Bill Goodwin- UPDATE IN POST #77

[Stampsfan]

As a now retired IT professional, this is absolutely shocking. I would not be doing business with anyone who does not use some kind of encryption for their clients passwords. Not acceptable in any way.

I've always suspected that bids are known to many auction sites, as that can be raw data that anyone with a modicum of SQL skills could find... but this is on another level.

Any auction house using Simple Auction Site is now off my bid list.

Thanks for sharing.

[Buythatcard]

Because of this thread, he received free advertising.

All of you who didn't know about the upcoming auction, now do.

[NATCARD]

As I woke up and read the continued thread I can not think of the last time anyone asked me for this info. Maybe back in the day before I used Simple Auction site when i used dry erase boards and took bids mostly by phone (back in 2009 and before). I see no reason to have access to any of this information and agree it should be blocked. If you forget you user password, GET A NEW ONE!

[Jim VB]

Originally Posted by Stampsfan

Any auction house using Simple Auction Site is now off my bid list.

Thanks for sharing.

I think that’s probably a step too far, at least for now. Most of the auction house owners I know are honest guys. Several have told me they have never had access to passwords. Others have cleared it up and said it’s an option that SimpleAuctionSite.com can turn on or off. Obviously Bill Goodwin had it turned on.

What needs to happen is that Freedman needs to confirm it’s an option.

Then the various auctions houses using his software need to make clear that they do, or do not, have access to this info.

Then, old time auctioneers, like Bill Goodwin, need to stay far, far away from technology they don’t understand! Anyone who sends out plain text, unencrypted, passwords in emails shouldn’t be trusted with your info.

[the-illini]

Originally Posted by Jim VB

I think that’s probably a step too far, at least for now. Most of the auction house owners I know are honest guys. Several have told me they have never had access to passwords. Others have cleared it up and said it’s an option that SimpleAuctionSite.com can turn on or off. Obviously Bill Goodwin had it turned on.

What needs to happen is that Freedman needs to confirm it’s an option.

Then the various auctions houses using his software need to make clear that they do, or do not, have access to this info.

Then, old time auctioneers, like Bill Goodwin, need to stay far, far away from technology they don’t understand! Anyone who sends out plain text, unencrypted, passwords in emails shouldn’t be trusted with your info.

Thing is, SimpleAuctionSite shouldn't have the ability to turn access to passwords on or off either.

[whiteymet]

I too received the email with my password and user ID.

Is there any thought to when I opened the link my computer could have been infected?

[edhans]

Originally Posted by whiteymet

Is there any thought to when I opened the link my computer could have been infected?

There was no link in the email I received.

[3-2-count]

Originally Posted by edhans

There was no link in the email I received.

There was in mine. Directly under my user name and PW.

[edhans]

Originally Posted by 3-2-count

There was in mine. Directly under my user name and PW.

The "link" was not live; that is, clicking on it would not take you directly to the website. I had to key the url into my browser. FWIW I didn't log in anyway. Was your email different?