Possible Player Auctions Security Problem

[meerkatlady]

To sell a runescape account on PA it asks you to upload a form of ID.

I was looking on the PA runescape accounts and (long story short)clicking just 1 button, was able to see the uploaded ID of the seller, I contacted 3 different members of their live support team but all 3 gave the same message, "its impossible". I gave them a printscreen of my computer and even recorded it on my phone but they just disconnect.

After about 20 attempts at it(wont disclose method but it simply involves clicking 1 button when viewing somebody else's account) I was able to see 5 uploaded ID's that contained Name, Address and other sensitive information.

Is this a big deal or not?

My skype is Meerkatmad123

P.S. Just realised this is not the right section : /

 

[Fendle]

To sell a runescape account on PA it asks you to upload a form of ID.

I was looking on the PA runescape accounts and (long story short) was able to see the uploaded ID of the seller, I contacted 3 different members of their live support team but all 3 gave the same message, "its impossible". I gave them a printscreen of my computer and even recorded it on my phone but they just disconnect.

After about 20 attempts at it(wont disclose method but it simply involves clicking 1 button when viewing somebody else's account) I was able to see 5 uploaded ID's that contained Name, Address and other sensitive information.

Is this a big deal or not?

My skype is Meerkatmad123

P.S. Just realised this is not the right section : /

Yes, it is a pretty big deal. PlayerAuctions.com are not known for their great security. They had their whole system infected with a RAT before.

 

[meerkatlady]

Yes, it is a pretty big deal. PlayerAuctions.com are not known for their great security. They had their whole system infected with a RAT before.

Ah good im not the only one that thinks its not just nothing.

I did my best to contact them directly and tell them about the problem so they could fix it. But the staff are just rude and don't seem interested.

I didnt want my details to be on show for others to see which is why im posting here.

 

I'd just keep trying with the support team. Let them know you're concerned for your own security.

http://www.playerauctions.com/help/contact-us/

Try "Report a bug" if you don't have any progress.

 

[Yenthe666]

Thats a huge problem, you should let that know to some upper staff or something.
Every single system these days seem to fail in such things, those data leaks are a threath to the users.

 

[meerkatlady]

I first went down the route of "just to let you know that..." being nice and so on.

That didnt work so I tried "im extremely mad that...." and so on

3 different people in live chat, I asked/demanded to speak to somebody higher up or their security team but all I got was;

"Can you proove it sir?" Then I proceeded to prove how simple it was

"You and our higher relevant team can see that information sir." Which wasnt true as I was able to do it

"As per checking, only our higher relevant team can see that."

"Okay, Ill give you the step by step for you to secure your information."

"It is 100% sure sir."

"It's up to you sir if you dont want to believe us."

They just wont acknowledge that the problem exists.

Ive given up with them now, but the problem still remains. I assume there is a large PA community on here so just wanted to warn them.

 

[Fendle]

I would never send a company like that my ID anyway.

 

[KnowP]

Playauctions is far from 100% safe. I know several ways to scam somebody on there. You have to stop thinking your safe from everything when using PA, what you need to do is think HOW you can slim your chances of getting scammed. Only deal with people you think have enough feedback to be trusted, because right now I could make an account and scam about $4000 within one week.

 

[Fendle]

Playauctions is far from 100% safe. I know several ways to scam somebody on there. You have to stop thinking your safe from everything when using PA, what you need to do is think HOW you can slim your chances of getting scammed. Only deal with people you think have enough feedback to be trusted, because right now I could make an account and scam about $4000 within one week.

You couldn't PlayerAuctions would block your account after 1 or 2 disputes.

 

[Heeatz]

Playauctions is far from 100% safe. I know several ways to scam somebody on there. You have to stop thinking your safe from everything when using PA, what you need to do is think HOW you can slim your chances of getting scammed. Only deal with people you think have enough feedback to be trusted, because right now I could make an account and scam about $4000 within one week.

OT: I never noticed that. Seems they just dont give a fuck:/

 

[Revolution]

Actually Playerauctions is very secure if you do 2 things:

1 - Deal with famous sellers (i.e: the people at top of the list)
2 - Use Moneybookers (They require no ID or anything, exactly like Paypal)

Moneybookers also has the least amount of fees. If you use these 2 methods, nothing is stored on PA's servers.

 

[meerkatlady]

I just dont understand how such a big and supposedly trusted company/website with good security allows such an easy breach.

Click 1 button on the seller's listing and I have their name, adress and every other piece of information on an ID.

 

[Delta Squad]

just put your not the original owner problem solved.

 

[Heeatz]

You're funny because it's coming from you, with a TWC. I doubt I'd even trade with you, to many risks of chargebacks unless you'd be willing to pay with WU, then a trusted MM would be used.

Yup im fuckin' hilarious. Im sure many would trust me over you; even with my twc buddy. Go dig for my twc reason; its a load of bullshit anyway; hoping to get rid of it soon enough.

Now lets stay on topic before i get infracted like you?

OT: Is there no way of hiding the info? Have you checked profile settings etc?

 

[GhosTy]

When'd this become a pissing contest about trust?? ^_^

ONTOPIC : I looked at PA before coming here and I decided I would rather not have a third party that can be so easily unsecured with my information. That's why I'm here since all my information is just basic stuff anybody can find anyway.

 

Who said PA is safe? PA as a company just won't chargeback you...

Wrong section.

 

[KnowP]

Yup im fuckin' hilarious. Im sure many would trust me over you; even with my twc buddy. Go dig for my twc reason; its a load of bullshit anyway; hoping to get rid of it soon enough.

Now lets stay on topic before i get infracted like you?

OT: Is there no way of hiding the info? Have you checked profile settings etc?

Glad I pissed you off, this moron lmfao.

OT: Email [email protected] you'll get more than the same answer everytime or they'll give you another email address to email.

 

[Zezecha]

Yup im fuckin' hilarious. Im sure many would trust me over you; even with my twc buddy. Go dig for my twc reason; its a load of bullshit anyway; hoping to get rid of it soon enough.

Now lets stay on topic before i get infracted like you?

OT: Is there no way of hiding the info? Have you checked profile settings etc?

Let me introduce myself. I'm Chris Hansen from Dateline NBC. Please take a seat, I'd like to speak with you. You have been banned atleast 2 times within the past month.
'Nuff said.

 

[GTI]

Who said PA is safe? PA as a company just won't chargeback you...

Wrong section.

This. Otherwisely then that, there system really sucks. I got scammed the first time, I bought some gold but the seller did not deliver, later on he showed fake edited screenshots. Unbelieveable.

 

[sl0ta]

Your information is stored on our servers. We treat data as an asset that must be protected and use multiple tools (encryption, passwords, physical security, etc.) to protect your personal information against unauthorized access and disclosure. However, as you probably know, third parties may unlawfully intercept or access transmissions or private communications, and other users may abuse or misuse your personal information that they collect from the site. Therefore, although we work very hard to protect your privacy, we do not promise, and you should not expect, that your personal information or private communications will always remain private.

.. this is in their Privacy Policy

PlayerAuctions will protect your Personal Information in accordance with the laws of the United States and the state of Delaware.

So if it is bug ,then its more like their problem and they can be even sued for it.