Comment · Thu, June 8, 2017 · Ceretropic & Nootropics Depot
Nootropics Depot asking for a lot of personal information just to make a purchase...
Original post in this thread
oompa_loompa0 · 44 points
I am trying to make my first purchase with Nootropics Depot. As you get 10% off as a first purchaser I decided I would stock up - to the amount of about $390 USD. I get this email a few days later, about noon'ish:
------
Thanks for your order! We have received payment on your order, however, our fraud protection software has flagged the order due to a recent amount of fraud. Because this is your first large order with us, our fraud prevention requires another step of verification. Typically this verification is handled by getting a scan of your identification, credit card used (you may redact all but the last four digits), and a copy of a utility bill that verifies your billing address. Once we have this information, we will then be able to approve this purchase, and we will not need to verify future orders.
If we do not receive a response regarding the verification of your order by the end of the day, we will unfortunately have to cancel your order. Sorry for any inconvenience.
You may use this secure form to send us your proof of identification for this order:
http://nootropicsdepot.com/payment-verification/
Once you have submitted the necessary documents, please let us kn…
What they were answering
Expo- · 7 points
Unfortunately people see this green lock, or the lack thereof, as a massive deal. An SSL certificate ensures information submitted is encrypted, but the end owner of the "secured" server could look at or even store any info submitted. Thus, NootropicsDepot should use a far more reputable "verification" method and I may reconsider my shopping as it seems the web developer/engineer is not properly doing their job if that position even exists. Hell, I'd help ND get this set-up to make myself feel more comfortable keeping my account there. This needs to be addressed by the owner and he needs to get someone to sort them out. Freelancers, once they've signed an NDA, can get this resolved. I recommend "Stack Overflow - Talent" to find the one to do the job. Verification is all up to a company to do, but they need to ensure the server itself is locked down (hopefully running Linux with nginx), and a secure connection to the server is established. ND is failing in this department at the moment. Any important payment and personal data absolutely needs to be encrypted when sent to the server and even hashed so that NootropicsDepot couldn't even see that information ever. Most companies allow themselves to see data like credit card numbers as that is far more convenient, but the end user would be better suited by full end to end encryption. /rant over lol
Edit: "NetVerify" is a highly re…
u/MisterYouAreSoDumb · Ceretropic & Nootropics Depot
Every single payment page is behind an SSL. Anyone saying different is lying! It has always been behind SSL since day one. The normal site pages are not, as they do not need to be. We have been considering putting all the pages behind SSL, but have not pulled the trigger yet, due to implications that will have.