discountcycleparts.com is insecure

[Low Life]

Everyone,

This post is to let everyone know that at the time being it is insecure to use credit cards on discountcycleparts.com. I've used this site in the past and it has not always been this way. Went to place an order last night and during the checkout process they were not using SSL to protect the transmission of credit card data from my client to their server.

This is very important to watch for during the check out process. Without properly encrypting this information its possible for someone to grab your credit card information enroute to the server. If you are using a wireless network that is misconfigured or if you are using a public Internet connection at the airport, coffee shop or any other wireless network with multiple people on it becomes very easy to steal this information.

I went ahead and placed my order but used Paypal to do it instead of using a credit card. After placing the order I received an error from discountcycleparts.com that said there was an error in the order even though the paypal money was sent. I sent an e-mail to the paypal address of: discountcycleparts@discountcycleparts.com but that e-mail bounced back as undeliverable from their mail server at register.com.

After all this I sent an e-mail letting them know the problems to sales@discountcycleparts.com and this is the response I received:

************************************************** *********
You are the first person to have this problem since we started this site, so i guess it is on us right, right. Your Paypal account will be refunded. Good luck finding what your looking for. Please do not write me and tell me that we need to fix what works fine, We have nearly 6000 satisfied customers, and nobody has ever contacted us with information such as this. We use the X-cart Shopping System and have Programming on our site that is very Unique. If Our Web mail Address comes back to you as invalid, I would check into what problems YOUR CPU has.

Good Day to You
-josh
************************************************** *********


Here are some screenshots showing that they are NOT using SSL during their checkout process. This could just be a simple misconfiguration in their Xcart software or this could be because they are cheap and do not want to purchase a valid SSL certificate. (Less than $50 per year from some sources)

This image shows their form collecting the credit card information. As you can see circled in red they are not using SSL to protect this connection.


This screenshot shows the actual packet going from my client to their server. This is the POST data from the packet itself. As you can see in the URL at the top they are NOT using SSL to protect the packet.



If you are going to order from them the only safe way is to call them and place your order or use paypal. I do not recommend using credit cards with them at all until they fix these problems.

[chopper]

I love that response. It must be your pc that is causing their site to have problems lol.

Thanks for letting everyone know. I have stuck it to the top. Google will have this in a few hours. It should do numbers for their rep.

[Stoney]

After the response they sent, I'd tell them to go fuck themselves anyway..... that's no way to respond to a customer complaint. They can shove their parts up their ass as far as I'm concerned.

[tcspannerwrench]

it kills me the way customer service has evolved. from these jackholes to the pimple faced fuck work at McDonalds. nothing piss's me of more than someone acting like i am bothering them when i am spending my hard earned dollar.

[pquirk]

Thanks Eric!

[Low Life]

Here are the e-mails that I sent them. I wasn't cheery in my e-mail reporting the problem but I wasn't an asshole either. They haven't returned the paypal money yet either.

**************************************
Just placed an order through your website for Custom Chrome part: 31658. I was going to use a credit card on your site but you are not using SSL to protect the data from me to your server. This is actually against PCI standards and you need to fix that.

I then placed the order and paid with Paypal. I have the confirmation from paypal that the order went through but I got an error from your site that said the order was not placed.


*************************************

I placed an order through your site and payed with PayPal. Please cancel this order and return the money. Your paypal address is bouncing back undeliverable and your website is not using SSL to transmit credit card information. I received an error after being redirected to your website after paying via Paypal.

****@*****.com is the paypal address used. Total was $64.98.


**************************************

[jamman]

way to go eric..

[WaBiker]

...Rep to you E-man..!

[Serg06]

Good lookin out.