galaad2's Journal: Sears at it again: burglar's reference

CA has another scoop on Sears

Sears' managemyhome.com site allows any burglar to case a home from the comfort of their armchair and provide them with everything they'd need to bluff their way through picking it up for a "recall".

quotes from TFA:

Once you register, you can look up major purchases for ANY address. All you need to do is enter a name, address and phone number and if the person attached to that info has made a major purchase at sears you get that info!! They have no real controls in place -- you have to enter an onscreen code and they say that keeps your info safe, but that does not stop someone from entering other people's contact info to see their product purchases.

I checked this out, and sure enough, in about 2 minutes I was looking at every purchase my parents had made since 1989. What's worse, I had used no more info than is publicly listed in the phone book: their name, address, and telephone number. Once you have an account at http://www.managemyhome.com/ and have logged in, select the first option (Home Profile) from the "Home" pull-down menu on the main page. In the upper right corner of the page, you should see a "Sears Purchase History", with a button labeled "Find my Products". The only information they asked for when I followed that button was a name, phone number, and address.

If you had major dealings with Sears, that information is now available to the public, from a television bought in 1978 to a stove which was purchased elsewhere but had been repaired by a Sears technician.

~~~~

Coworker checked it out

[Qzukk]

Thought it was a cool idea and looked up his buying history, except he mistyped his address. It still displayed the washer and dryer he had purchased. It looks like the product lookup only looks at last name and phone number, even though the other fields are "required".