Disturbing security issues at CWC

[penny-slot-machines]

I have two security issues with CWC that need addressing

1) Today, I was sent an email, apparently from CWC - it contained both my login and password. The email came from worldonlinegaming@communicatoremail.com and was a standard marketing email advertising their services

I had not asked for my login or password to be sent to me

I feel it is very unsafe to be sent both login and password in a standard marketing email - I should only be sent those details if I request it and the process should be as secure as possible, preferably involving a couple of security questions

If someone were to access my account, they could get hold of my name, address, phone number and neteller ID - I don't want anyone getting all that information!

2) Also, I notice that when I login to the CWC affiliate page and click on the 'preferences' panel, it shows my password completely openly, not encrypted in any way whatsoever! There is no reason whatsoever to have a password openly shown like this - If I have logged into my account, then I know my password and it does not need to be openly shown, so that others in my office can see it if they pass by whilst I'm looking at my account

Anyone else having these or other security issues with CWC?

[universal4]

Interesting.

I agree there shouldn't be any reason to show the password in open text after logging in.

Are you sure the email that contained your details was not sent by a password request? Maybe someone else performed the request??

I agree that the only time the password should be emailed from the database is when requested to the original email account on record from a forgot password form.

Rick
Universal4

[universal4]

Actually, this made me wonder so I took a look around and I didn't even see a forgot password form....

hmmmm....

I do see the password in a marketing email as a serious security risk. I mean how many webmasters might unknowingly send this mailing to a prospective sub-affiliate to try and close a sale on a sub signup?

Martyn, would like your thoughts on this.

Rick
Universal4

[penny-slot-machines]

Are you sure the email that contained your details was not sent by a password request? Maybe someone else performed the request??

Yes, absolutely sure


This is the from/subject/date information:

From: worldonlinegaming@communicatoremail.com
Subject: CWC Affiliate Newsletter
Date: 28 August 2009 16:48:58 BST



And this is the content of the email (I've put XXXX in where my details had been placed):

Hi XXXXXX,

Please check out our latest newsletter, it has some exciting news regarding the re-launch of one of our brands. Also in this edition:

Aladdin’s Gold V.2.Awesome
Budapest Affiliate Conference
New Creative
Please follow this link to view all the latest goings on at CWC Affiliates...

http://www.cwcaffiliates.com/affnews...7/09august.htm

Your CWC login: XXXXXXXX | Password : XXXXXXXX

If we can work together on anything else I would love to discuss what options are open to us and help build a successful campaign with CWC Affiliates.

Regards,
_______________________________
Martyn Beacon
Affiliate Manager | CWC Affiliates.com
Skype: M8ECO26

Tel: +44 (0)161 211 1354




If you do not wish to continue receiving these emails, please Unsubscribe

[penny-slot-machines]

By the way, I have emailed Martyn about this, but thought it was important enough to post the details here too, so people can be aware

Some affiliates may use the same login details for many different accounts, or even for their online banking, who knows?

You wouldn't want those login details unnkowingly being stored in your computer's email mailboxes - if someone steals your computer they would have access to those password...

[Engineer]

Mainstreet and Jackpot Capital show the password openly, too.

[Anthony-Coral]

well I've sent martyn the link to this thread by all the contacts I have for him.

If there is something that needs fixing there is no doubt he'll do what's required

[AE-Martyn]

Hi there,

Thanks for raising this.

This was an email sent by me pertaining to the affiliate newsletter for this month.

I included the login information due to the number of lost password requests that I have received recently, I thought it was a decent idea at the time and following these posts and your thoughts on this it will not be done again and I appreciate your concern. However, these same details are sent to you when you sign up in the welcome email, for reference as with most if not all programs.

As for the password being shown in your account, I will again pass this on to RTG to take action towards showing the password as hidden text.

Sorry if you feel this is a security breach but it was done in good faith.

Rick, regards a webmaster sending this on to close a sub deal I think this is highly unlikely as the newsletter which would be sent on is contained on a seperate link which contains NO affiliate data.

Thanks also to Hodgey for getting in touch to raise this with me late on a Friday evening here in the UK.

[Anthony-Coral]

Hey......





Who loves ya, baby!

[penny-slot-machines]

Hi Martyn,

Thanks for responding to this so quickly, especially on a Friday night!

Obviously RTG originally intended the password to be displayed as hidden text, because they also provide a "confirm password" box on the same page...

Cheers again,

Bill

[AE-Martyn]

Hey......





Who loves ya, baby!

My mummy....

Hi Martyn,

Thanks for responding to this so quickly, especially on a Friday night!

Obviously RTG originally intended the password to be displayed as hidden text, because they also provide a "confirm password" box on the same page...

Cheers again,

Bill

Not a problem, sorry if it caused concern and I hope the cider isnt showing in my posts. Aftryall i tend nit ta drunk whyle workin. *burp*

[Chalkie]

I hope you are a real drinker and have lager with that cider!



Although i suspect that coming from manchester it is more likely to be a WKD cider drink

[penny-slot-machines]

How about a pint of real beer, instead of these teenage girl drinks?

[AE-Martyn]

I hope you are a real drinker and have lager with that cider!



Although i suspect that coming from manchester it is more likely to be a WKD cider drink

Funny you mention the lager, I got a Bud in hand right now.

And I only stick bottles of WKD to my head...but that is another story!

[Chalkie]

How about a pint of real beer, instead of these teenage girl drinks?

I spent a night in a marquee drinking real ale at the Great Orsett Steam Fair years ago, walked out of the marquee to retire to my tent and nearly got squashed by someone equally anebriated driving a steam roller!

Dangerous stuff that real ale!

[universal4]

Rick, regards a webmaster sending this on to close a sub deal I think this is highly unlikely as the newsletter which would be sent on is contained on a seperate link which contains NO affiliate data.

Point taken Martyn, it's just one of those rare "what-if" scenarios that "could" happen.

But you see, security-wise, that is what a good security auditor tries to think about....the more "what-if's" that are covered the better and safer things can be....

A healthy discussion none-the-less.

Rick
Universal4

[Daera]

Point taken Martyn, it's just one of those rare "what-if" scenarios that "could" happen.

But you see, security-wise, that is what a good security auditor tries to think about....the more "what-if's" that are covered the better and safer things can be....

A healthy discussion none-the-less.

Rick
Universal4

Login names and passwords together, mailed out when not requested is a very big security issue IMO. About a year ago or so, I had 3 of my better affiliate accounts compromised. Somehow someone got access to these 3, changed my Quicktender account to theirs. Changed my email (which was gmail) to theirs (which was gmail). And they almost got my money.

Thank god I tried to login to Rewards at the end of the month and when my password didn't work I tried the lost password. When it didn't recognize my email address at all in thier system... I freaked.

Fortune, Rewards and Pantasia had all had this done by the same person. If I had not have been checking stats at the end of the month... I would have really been upset when I got no payment from those 3 programs.

Security should be really taken seriously with affiliate accounts.