Free Gripped Subscription

[hardcoreclimbers]

Want a free subscription to Gripped?
Know someone else who already has a subscription?
Know their email address?

Easy! Here’s how:

1. Click “Subscribe” from the Menu
2. Click “Customer Care” from the Sub Menu
3. Click “Change Mailing Address”
4. Enter in the email address, click “Login”

Now if they have a subscription, you should see their existing mailing address. Hmm…Not very nice to know that someone can discover where you live just by knowing your email!!

Let’s continue:

5. Click “Customer Care” from the Sub Menu again
6. Click “Change Mailing Address”
7. Put in your own mailing address the click “Submit”

Now wait for the next issue to be delivered to you for FREE!

If you want, you can even change the email address you used to something else… soo wait… does that mean you’ve 100% hijacked the subscription? wtf?

I’ve told Gripped about this problem with their website and they basically brushed me off. What do you guys think? Is this not a problem to be dealt with?

[hardcoreclimbers]

You do all these steps at http://gripped.com

[Bruehaha]

You should change the title to 'How to steal a Gripped subscription.'

[hardcoreclimbers]

That's my whole point. Gripped has a bug that let's you steal other people's subscriptions. I also don't want people to find out where I live (my mailing address) just by entering my email.

[John Doe]

Thats pretty weak if you ask me. Why haven't they fixed that? How long has it been going on?

I ask because I have a subscription myself... maybe i should change my own email...

[hardcoreclimbers]

I discovered it in September when I legitimately wanted to change my whole address, but realized that I only had to provide an email to do the deed. I told a friend about it and he changed my address to his own so I had to change it back.

I sent an email to Gripped and told them exactly what the problem was. The person who got back to me passed the blame on to some other company that manages Gripped's subscriptions. I told him my subscription was with Gripped and that it's his responsibility to fix it. I said I'd give him some time, but if nothing got done, I'd let the World know that their private information isn't safe on the Gripped website. Hence this post...

Also note that I put the same post up on Gripped's forum, but as expected, they pulled it within 15 minutes. It's kind of like 1984 over there.

[John Doe]

Well lets keep posting on the Gripped BB and just run them down.

I think that this is pretty poor of Gripped, not to mention a huge breach in privacy laws...

[corn_dog]

Wow this is really bad, I can't believe they won't fix it! I just hacked my friends subscription!

Dan

[Anders Ourom]

Consider that Gripped likely has good records (paper and electronic) as to who its subscribers are. Consider also that your computer probably leaves a traceable record if you change a subscription record as suggested. Consider that if you divert a subscription to your own name and address, it isn't hard to trace. If you divert a subscription to someone else, you still leave something traceable.

Consider whether you feel like being charged for theft, or simply outed as a fool.

[John Doe]

I'm sorry Anders, your comment has many flaws. Whoever brought this up isn't actually trying to hack other people's account, he just doesn't want his account to be viewable by entering an email... you're missing the point.

Also, you're saying that if i walk down to Starbucks, log into their WiFi, change someone's address to 1234 Made Up Rd, that's it's gonna get traced back to me??

You're making up facts when you don't even know how a system works. Why didn't gripped just patch this hole before it was made public?

[hardcoreclimbers]

Anders,

The issue here is not about stealing subscriptions from others. The issue is about Gripped permitting it to happen with full knowledge that the exploit exists. Wouldn't you be upset if you found out that anyone could log onto your bank account and see all of your banking transactions? Then wouldn't it be more upsetting if your bank knew about the problem, but didn't do anything to resolve it? In an email, I was literally told "This was not a problem until you told everyone that they could get your subscription if they used your email address." So just because no one knows about the problem (with a big YET), it's NOT a problem???

Okay okay... Let's forget all this stealing of subscriptions BS. Privacy violation is the big concern here. This is the NUMBER ONE issue.

Anybody who knows your email address can find out your home address! You want me to prove my point? I just Googled your name, found a page that lists your email. Then I put your email address into Gripped's subscription (dis)service and found out that you live off of Cambie. Feel violated?

I work in the tech industry and this is a huge no no. People don't want others to have access to their information. This is why I'm making such a huge deal about this. Gripped has so far done nothing to resolve the problem and hopefully by calling them out, they'll fix it ASAP.

Consider that.

[John Doe]

Wow, I couldn't have said it any better myself. I wonder how Gripped feels?

Anders,

The issue here is not about stealing subscriptions from others. The issue is about Gripped permitting it to happen with full knowledge that the exploit exists. Wouldn't you be upset if you found out that anyone could log onto your bank account and see all of your banking transactions? Then wouldn't it be more upsetting if your bank knew about the problem, but didn't do anything to resolve it? In an email, I was literally told "This was not a problem until you told everyone that they could get your subscription if they used your email address." So just because no one knows about the problem (with a big YET), it's NOT a problem???

Okay okay... Let's forget all this stealing of subscriptions BS. Privacy violation is the big concern here. This is the NUMBER ONE issue.

Anybody who knows your email address can find out your home address! You want me to prove my point? I just Googled your name, found a page that lists your email. Then I put your email address into Gripped's subscription (dis)service and found out that you live off of Cambie. Feel violated?

I work in the tech industry and this is a huge no no. People don't want others to have access to their information. This is why I'm making such a huge deal about this. Gripped has so far done nothing to resolve the problem and hopefully by calling them out, they'll fix it ASAP.

Consider that.

[Cloudraker]

I feel so violated!!

[Dru]

why would anyone subscribe to Gripped?

[Anders Ourom]

Anybody who knows your email address can find out your home address! You want me to prove my point? I just Googled your name, found a page that lists your email. Then I put your email address into Gripped's subscription (dis)service and found out that you live off of Cambie. Feel violated?

Actually, no. I don't live off Cambie, at least not in the sense that "off Cambie" is usually used - I'm about 4 km west of there. And Gripped is mailed to my post box, which I use for business mail. You may find it harder to discover my home address.

In this day and age, it can be hard to hide, although certainly businesses have an obligation to protect the privacy of their customers. It's quite surprising what you can find if you're persistent and imaginative.