https://secure.sunflowerbroadband.com/billpay2/add

Allows you to check your bill by entering your account ID. Thing is the numbers are incremented so you can find other accounts and view their info. This also allows you to verify the existence of a live account for more fun to come. (Note: many numbers will not work since many accounts will be deactivated due to this being a college town and residents constantly changing residences.) I would post an active account number to start off with, but would rather not post someone's info in case someone does something bad.

Now the fun part. https://my.sunflower.com/mybbauth/login/register
To make an account online all you need is the account ID. There is no other form of owner validation present. Doing so you can then create ISP email addresses for the account, view billing information in full, change billing preferences etc. If you are really nice you can even pay the person's bill =oP

Of course I have called them and told them of this, but their reasoning is that the information is in the phonebook so its not a privacy concern. I don't think they fully grasp the fact that someone can create email addresses to spam from, change someones billing prefs so their bill is never received and worst of all this is a clear violation of the Cable TV Privacy Act of 1984 because they allow the divulging of PII of their customers not to mention allowing someone to also see their viewing habits according to channel subscriptions.

They seem to have no idea what security and privacy is. When you call them on their customer service line they ask for the home address and then before any validation they divulge the account holder's name by saying "Is this John Doe?" Not to mention the passwords for the online accounts are not hashed because I called once about my bill not showing up and the support rep asked me if such and such was my password (64 char alphanumeric mixed password). He thought it was an error showing up. So its great reps can see my password whenever they please...

Sucks that I am stuck with them, but who's complaining...? O.O

Maybe this could convince them to fix at least some of their problems..

.mario Wrote:
-------------------------------------------------------
> Maybe this could convince them to fix at least
> some of their problems..


I appreciate the tradition of randomly auditing sites for xss bugs and all (even though I think it's a waste of time and a bit of a circle jerk), but somehow I doubt showing someone an xss which alerts the word "moo" will convince a company who doesn't see a problem with a customer's data being available to anyone who wants it.

----------------------------------------------------------
Don't forget our IRC: irc://irc.irchighway.net/#slackers
[kuza55.blogspot.com]

I agree with kuza55. I think "BOO!" might be better at scaring them. ;)

--thrill

---

It is not the degrees you hold, but the mind you possess. - thrill

@kuza55: I appreciate the tradition of randomly ranting on other peoples posts and all (even though I think it's a waste of time and a bit of a circle jerk), but somehow I doubt showing someone a totally useless state of mind of yours will change anything at all or even at least impress anyone. Moo.

@thrill: I totally agree.

.mario Wrote:
-------------------------------------------------------
> @kuza55: I appreciate the tradition of randomly
> ranting on other peoples posts and all (even
> though I think it's a waste of time and a bit of a
> circle jerk), but somehow I doubt showing someone
> a totally useless state of mind of yours will
> change anything at all or even at least impress
> anyone. Moo.

Haha, touche.

----------------------------------------------------------
Don't forget our IRC: irc://irc.irchighway.net/#slackers
[kuza55.blogspot.com]