Storage Battles Makes Huge Security Blunder

Upon additional analysis of the email addresses showing, that's the name the person choose as their user ID.  Those people are just idiots who did that.

Now here's the fun part, but I'm sure Jim already knows this cause he has an ACE *Security Adviser* cough.

Say I want to win an auction, or try to snipe it, in the final minutes and I know the bidder I'm up against and their Internal ID used by storage battles.

storagebattles.com/profile/?logmeout=please&loid=XXXXX

Just replace the "XXXXX" with the ID you want to log out, set it as a loop to prevent that user from logging in and bidding, until the auction is over.

Lets say an employee at SB provides the complete list of ID and user names to a person or a friend that's interested in a unit. Then they can exploit it.  Let's say a person got a friends ID from just looking at the html, while his friend was logged in and jotted it down.

He still hasn't fixed the SSL issue when logging into or creating a new account..

 

Anything in the internet is no longer considered private – I think everyone knows that. But for anyone who is able to make a ‘guess’ on how to find out personal information given the initial email to re-register in the new website, I think that is dangerous and it compromises the trust of everyone. Has anyone followed up on this so that there is no further compromise being done? The fact that you can search users’ email addresses, and with the re-registration instruction, that can make anyone log on to anyone’s account!