Stupid Drivers-Ed Website

[Nathan4102]

Why is he able to take me to court for publicising their mistake though? He (or his IT team) is the one who put his customers privacy at risk, and, should it come to this, refused to fix it. As a customer with my personal data at risk, I should be able to take steps to get this fixed, no?

[Dan]

Nathan4102 @ 19th May 2013, 9:55 pm wrote:

Why is he able to take me to court for publicising their mistake though?

Any one can take any one to court for anything. Tho that does not mean he would win the law suit. For example Lanschool threatened to take myself and CompSci.ca to court over details of an exploit to there software being posted here. They even had a real law firm draft the legal threat for them. However I should note that we are on good terms with Lanschool now and they are far more receptive to reports of exploits.

The point is even if they are in the wrong, they still may react poorly.

[Nathan4102]

Oh ya, I remember hearing about that. I guess i'll wait and see what they have to say tomorrow, Ill let you guys know what happens.

[Nathan4102]

Finally got ahold of the CEO today, he said that a "Security Certificate" had expired, and they're working on renewing it. Since I know next to nothing about this web stuff, I accepted the excuse. Could an expired security certificate be the reason I can view everyones information with ease? I'm not too sure what action to take now, I guess I'll just give him some time to get it sorted.

[md]

A "Security Certificate" probably means an SSL certificate and would have zero impact on this particular security issue.

[Nathan4102]

I guess the CEO forwarded me to his IT team after that call, another employee emailed me shortly after and told me this was a major security loophole, and they're working on a solution. Thanks for the advice guys, I'm glad this didn't come to a legal battle!

[mirhagk]

This is how things work in the business world, you e-mail the website and get to talk to either a random business person, or secretary, who talks to the IT team who stand there and mumble things to each other for a second, then the secretary/business person goes back and sends off an e-mail that makes no sense. Every once in a while you get lucky, and the IT team get's CC'd in, and one of the staff sees how dumb the response was, and takes a few minutes of their team to send a proper one.

I'm glad they recognized it as a major security loophole, and a solution should hopefully come out soon (which probably translates to in a couple months)

[Nathan4102]

Yeah, they said they'd have it patched in a couple of hours, and that was about 6 hours ago. Atleast they're working on it though, thats all I really wanted.