Watchfire: unauthorized login?

I'm totally confused by this one :D

For one of my classes, we had to get some data from GomezPro ( https://www.watchfire.com/gomezpro/login.aspx ). For non-subscribers, only partial data is available. By accident (really!) I hit the "Submit" button in the Customer Login box without filling out a username/password. The thing logged me in, saying "Welcome Marne Gabay of HSBC". Oooookkkkk.... I'm not sure if Mr. Gabay would appreciate that. It worked a week ago, and it still works (on both our laptops and a desktop) - only works in Firefox, though... IE gives a "Not a valid login", the way it's supposed to be.

I sent them a couple of e-mails - check out what that company does: http://www.watchfire.com/services/default.aspx - they help other companies secure their online presence :p

Never heard back from them, so here I am... any idea on why/how? Anyone able to reproduce this?

Quote:

---

Welcome Marne Gabay of HSBC.

---

Reproduced using Foxfire 1.0. I mailed them too.

Thanks! That rules out IP-mixups, I guess...
I tried everything I could to contact them, and have been for over a week - including asking for a representative to call me about their products... I refuse to call them, though, cause I'm not going to pay long-distance if they're too lazy :p

screw 'em. if they want bugs on their site that's their business. we both did the ethical thing by notifying site support.

this flu is kicking my ass. pardon my lack of the usual verbose geniality.

I just tried it also.....and

Quote:

---

Customer Login:

Welcome Marne Gabay of HSBC.

---

That was with firefox 1.0 also. But I am not going to mail them about it.....if they haven't had the courtesy to answer you guys, I am not going to waste my time.

[edit] Just a thought....you don't suppose that this Marne Gabay registered with a blank username and blank password . Security by oblivian.

got the same as you guys. im gonna email them.

From the delerium comes a weird thought:

What if it's a honeypot setup? Nah.. couldn't be that easy and surely they would've responded to our emails if it were...

Honey pot is a possibility, but I doubt it. I did some further navigation, and when you try going to the "customer portal" section it will ask again for the username and password. But this time you actually need to put on in.

I got a response from their support team, they said they have fixed the issue. I tesed it and they are correct.

Heh... they could have told me that a week ago.. why didn't they email me back? :bawling:

It's indeed fixed now... I got everything I needed, though :D