09 - Insecure Order Form :)

Przemolog · 19-01-2006, 21:59

Here we place an order (incl. credit card data):
http://www.09.is/orderform.php

And here is the action URL used after the form is submitted:
http://www.09.is/orderform_process.php

Moreover, it's possible to submit the form with any contents, even EMPTY, without any client- or server-side validation! All what is displayed is:

Form submitted...

Thank you !

What the hell is that??? :umm:

RTuesday · 20-01-2006, 02:47

Quote:

Originally Posted by Przemolog

What the hell is that??? :umm:

I agree no security on credit cards is bad, but the lack of validation makes little difference. I think their current order process is to print out the orders every month or two (when they're reminded by somebody wondering where their card is).

They then send them over to Orate in the UK, who sit on them for a while even when reminded, and then eventually send them out by slow post. (in my case, they didn't even accept the credit card that was acceptable on the 09 form).

I wonder how many customers have jumped through these hoops so far, for a card with ZERO support that can't make outgoing calls in many countries where it is supposed to work... it must be a very small number.

Having said that, I'll be using the card again with callback in Mexico next week, saves a lot, and I won't be tempted to call direct (because I can't!) rather than callback for a quick call.

Stu · 20-01-2006, 03:22

My credit card allows me to generate a one-off number for transactions. I used one of those numbers when I made the purchase. My wife is using the cared in the UAE right now and it is way cheaper than any other way to make international calls in the UAE. It even beats the best contract plan. We obviously are using the same technique that you are.

Stu

maccoy · 05-03-2006, 11:16

I was going to buy a 09 starter pack but when I noticed that the form wasn't secure I decided to stop...
I think I will place my order on the Orate site, but I keep asking me what will I do when I'll need to recharge my 09 account.
In fact on the Orate site a 25? recharge costs about 30? and I don't like to spend more than the credit I will get.
I also noticed that on the 09 site the products have no price, so you will discover the surprise after the credit card will be billed.
I don't think this is a serious way to manage...

Przemolog · 05-03-2006, 11:39

Quote:

Originally Posted by maccoy

I was going to buy a 09 starter pack but when I noticed that the form wasn't secure I decided to stop...
I think I will place my order on the Orate site, but I keep asking me what will I do when I'll need to recharge my 09 account.

I think you can do this from 09 site:
https://topup.09.is/topup/

But to do this, you must register first:
http://www.09.is/orderform_topupregisteration.php
and it's again insecure one with mandatory fields for the credit card data

Quote:

Originally Posted by maccoy

I also noticed that on the 09 site the products have no price, so you will discover the surprise after the credit card will be billed.
I don't think this is a serious way to manage..

I agree...

maccoy · 05-03-2006, 12:01

Thank you for the links.
Unfortunately they still ask to give my credit card data on an unsecure form.

I think I will wait to buy a 09 card until they will get more serious (although I'm strongly tempted to buy one).
In the meantime I wrote to them asking a secure form or a french reseller...

DTele1 · 06-03-2006, 19:32

I think that 09 is not really selling anything direct, they only take your credit card to pre-register you for their menu topup - http://www.09.is/orderform_topupregisteration.php

I filled in my information on 09.is and got an email from Orate the next day, so I gues that Orate is following up on their other sales leads.

OTOH - I found another site that offers the 09 cards, including reload codes by email - http://www.simphonee.com

Hope this helps,

maccoy · 06-03-2006, 19:34

I got an answer, not from 09 but from Orate...
It seems that they are the only reseller.
The thing I still don't understand is why should I pay in pounds a product that uses euros as official currency.
And they didn't answer my question: If I would like to use the direct top up I still have to register my credit card on an unsecure form?

Stu · 06-03-2006, 19:44

pharosint.com also sells the sim and recharges.

maccoy · 06-03-2006, 23:16

Quote:

Originally Posted by DTele1

OTOH - I found another site that offers the 09 cards, including reload codes by email - http://www.simphonee.com

Hope this helps,

Unfortunately it doesn't seem to work...
Or am I wrong?

	(#1)
Przemolog (Offline) Senior Member Prepaid Guru Posts: 1,211 Join Date: 06 Feb 2005 Location: Swidnik-home, Lublin-work Country:	19-01-2006, 21:59 Here we place an order (incl. credit card data): http://www.09.is/orderform.php And here is the action URL used after the form is submitted: http://www.09.is/orderform_process.php Moreover, it's possible to submit the form with any contents, even EMPTY, without any client- or server-side validation! All what is displayed is: Form submitted... Thank you ! What the hell is that??? :umm:

	(#3)
Stu (Offline) Senior Member Prepaid Guru Posts: 1,091 Join Date: 11 Feb 2004 Location: Detroit (formerly Dubai) Country:	20-01-2006, 03:22 My credit card allows me to generate a one-off number for transactions. I used one of those numbers when I made the purchase. My wife is using the cared in the UAE right now and it is way cheaper than any other way to make international calls in the UAE. It even beats the best contract plan. We obviously are using the same technique that you are. Stu

	(#4)
maccoy (Offline) Senior Member Prepaid Fan Posts: 194 Join Date: 23 May 2004 Location: Paris Country:	05-03-2006, 11:16 I was going to buy a 09 starter pack but when I noticed that the form wasn't secure I decided to stop... I think I will place my order on the Orate site, but I keep asking me what will I do when I'll need to recharge my 09 account. In fact on the Orate site a 25? recharge costs about 30? and I don't like to spend more than the credit I will get. I also noticed that on the 09 site the products have no price, so you will discover the surprise after the credit card will be billed. I don't think this is a serious way to manage... Prepaid I: Vodafone, Wind, 3; F: Bouygues Telecom; M: Melita; INT: Travelsim, Zeromobile.

	(#6)
maccoy (Offline) Senior Member Prepaid Fan Posts: 194 Join Date: 23 May 2004 Location: Paris Country:	05-03-2006, 12:01 Thank you for the links. Unfortunately they still ask to give my credit card data on an unsecure form. I think I will wait to buy a 09 card until they will get more serious (although I'm strongly tempted to buy one). In the meantime I wrote to them asking a secure form or a french reseller... Prepaid I: Vodafone, Wind, 3; F: Bouygues Telecom; M: Melita; INT: Travelsim, Zeromobile.

	(#7)
DTele1 (Offline) Junior Member Newbie Posts: 6 Join Date: 14 Feb 2006 Country:	06-03-2006, 19:32 I think that 09 is not really selling anything direct, they only take your credit card to pre-register you for their menu topup - http://www.09.is/orderform_topupregisteration.php I filled in my information on 09.is and got an email from Orate the next day, so I gues that Orate is following up on their other sales leads. OTOH - I found another site that offers the 09 cards, including reload codes by email - http://www.simphonee.com Hope this helps,

	(#8)
maccoy (Offline) Senior Member Prepaid Fan Posts: 194 Join Date: 23 May 2004 Location: Paris Country:	06-03-2006, 19:34 I got an answer, not from 09 but from Orate... It seems that they are the only reseller. The thing I still don't understand is why should I pay in pounds a product that uses euros as official currency. And they didn't answer my question: If I would like to use the direct top up I still have to register my credit card on an unsecure form? Prepaid I: Vodafone, Wind, 3; F: Bouygues Telecom; M: Melita; INT: Travelsim, Zeromobile.

	(#9)
Stu (Offline) Senior Member Prepaid Guru Posts: 1,091 Join Date: 11 Feb 2004 Location: Detroit (formerly Dubai) Country:	06-03-2006, 19:44 pharosint.com also sells the sim and recharges.