Member Website Security?????

[LoveToDisney]

There's a thread that is talking about all the things you can look up on the dvc member website--checking points, looking at contract info and dates of reservtions. I mentioned security issues on that thread but think it got buried so here it is...

Does it bother anyone that NONE of this info is on an "https" secure server and all our sensitive information such as contract number, dates of reservations, etc. are accessible to anyone on the internet as we receive those pages to view since it is not coming over a secure server???? If anyone was monitoring the site, they could glean a TON of information because it is all coming via text rather than over a secure site. I don't understand why DVC has allowed this?

 

[Galahad]

There's a thread that is talking about all the things you can look up on the dvc member website--checking points, looking at contract info and dates of reservtions. I mentioned security issues on that thread but think it got buried so here it is...

Does it bother anyone that NONE of this info is on an "https" secure server and all our sensitive information such as contract number, dates of reservations, etc. are accessible to anyone on the internet as we receive those pages to view since it is not coming over a secure server???? If anyone was monitoring the site, they could glean a TON of information because it is all coming via text rather than over a secure site. I don't understand why DVC has allowed this?

OK, color me stupid. How do I look up my points on the DVC website? When I log on to it I can't find an option to see anything specific to myself.

 

[LoveToDisney]

OK, color me stupid. How do I look up my points on the DVC website? When I log on to it I can't find an option to see anything specific to myself.

Click on "My DVC" and you will then see options to click on, such as contract info, points, reservations, etc...can't remember the actual names. As you click on each one and the info is brought up, that info is coming over a http server without any safeguard toward that text so anyone in the world can see it if they are monitoring that site. They should instead have the information on a secure server (https) to everything sensitive is encrypted.

 

[bullpup12564]

Any idea if this is a cost issue or an oversight?

 

[Galahad]

Click on "My DVC" and you will then see options to click on, such as contract info, points, reservations, etc...can't remember the actual names. As you click on each one and the info is brought up, that info is coming over a http server without any safeguard toward that text so anyone in the world can see it if they are monitoring that site. They should instead have the information on a secure server (https) to everything sensitive is encrypted.

Ah thanks. Perhaps it's lack of inutitiveness is security enough . Reservations are still just a "request" right? You can't actually check availability online can you?

 

[Daddio]

There really isn't much information would be useful to a hacker without your personal information, none of which is visible on the non secure pages. Once you go into fee payments or personal profile, you are redirected to a secure server.

 

[Chuck S]

Besides, there is certainly much more info available on the County site listing deed info, contract pricing and mortgage info. Don't even need a password for that...it is public record.

 

[LoveToDisney]

Besides, there is certainly much more info available on the County site listing deed info, contract pricing and mortgage info. Don't even need a password for that...it is public record.

But it doesn't list your upcoming vacation dates like the DVC site does along with your contract number.

 

[Chuck S]

But it doesn't list your upcoming vacation dates like the DVC site does along with your contract number.

Actually, the county site does list your contract number, not your membership number. At least the DVC site makes you log on, and you can't access any other member's info.

 

[Daddio]

There is nothing one could do if they had your vacation dates and contract/membership number.

They would also need a fair bit of personal information and none of that is transmitted insecurely.

 

[LoveToDisney]

.....At least the DVC site makes you log on, and you can't access any other member's info.

And the log on screen is not secure either--it's appears only to be http.