$5.00
$15.00
$20.00
$30.00
Diane Close
United States
Saint Paul
Minnesota
flag msg tools
mbmbmb
Repos Productions/Sombreros Production SPRL unveiled a brand new online store today, and I ordered a couple things. I found a few issues that they should address, including one security issue:

- all the old accounts are gone. If you've ordered from them previously, you'll need to register again.

- Everything is in English except country information. So États-Unis on the shipping form it is, for me!

- Most disturbingly is that once you register, Repos' site emails the login details for your account, in plain unsecure text, back to you, including your password!!!

It is imperative, if you value your account's security, that you log back in and change your password to something else, immediately!

I have written to them to make them aware of the problem* and hopefully they'll fix it asap, but no guarantees they'll address it, so be aware and practice safe internet shopping!

*Edit, November 30th: I have received no response from Repos about this issue.
18 
 Thumb up
0.25
 tip
 Hide
  • [+] Dice rolls
Kevin Tierney
United States
Portland
Oregon
flag msg tools
mbmbmbmbmb
Thanks for the post!

I agree that stores shouldn't be emailing customer passwords.

As a test, I went to the site and used the "Checkout with Paypal" option. I did not have to create a user account on their site at all with that option, so no new password was created/stored/emailed.

It worked the same as checking out from the BGG store w/ Paypal.

I have no idea if using Paypal to checkout has its own security risks, but it was certainly faster than having to create an account and type my address etc.

Very happy to get the new 7 Wonders Duel promos too!
7 
 Thumb up
0.25
 tip
 Hide
  • [+] Dice rolls
Diane Close
United States
Saint Paul
Minnesota
flag msg tools
mbmbmb
kevinpdx wrote:
As a test, I went to the site and used the "Checkout with Paypal" option. I did not have to create a user account on their site at all with that option, so no new password was created/stored/emailed.


Wonderful! Thanks for letting everyone know. I didn't use the "Checkout with Paypal" option, because I wanted to have an account on the site, thus I was quite surprised to have my login and password emailed to me afterward. I'm glad to know there's a (possibly) more secure alternative. Thanks for posting the details!
 
 Thumb up
 tip
 Hide
  • [+] Dice rolls
Diane Close
United States
Saint Paul
Minnesota
flag msg tools
mbmbmb
I should also point out, that the fact that they email passwords to users means that they are likely storing your password in plaintext, unencrypted. So do not reuse a password you've used anywhere else to access the site, make sure it's unique. (That's just good security practices advice in general. In 2016, you really shouldn't be reusing your passwords on any sites.)
4 
 Thumb up
 tip
 Hide
  • [+] Dice rolls
Hedyn Brand
Norway
Oslo
Lethargy
flag msg tools
Nothing to see here. Move along.
badge
Rules? I gotta read RULES‽
mbmbmbmbmb
pdclose wrote:
I should also point out, that the fact that they email passwords to users means that they are storing your password in plaintext, unencrypted.

Not necessarily - the password could be generated, mailed, stored in hashed form and thought safe. Which is still pants-on-head stupid, and with all the flaws they probably don't do that, and if any hashing is done at all it's MD5.

Checking out with PayPal should be safe, but use an alias e-mail if you can. If they can't handle passwords they're not likely to have great security in general, and the user database might just take a walk around the 'net someday.
2 
 Thumb up
0.25
 tip
 Hide
  • [+] Dice rolls
Will
United States
Fresno
California
flag msg tools
mbmbmbmbmb
This is part of why I use a unique password AND unique email for everything I sign up for.
3 
 Thumb up
 tip
 Hide
  • [+] Dice rolls
Hedyn Brand
Norway
Oslo
Lethargy
flag msg tools
Nothing to see here. Move along.
badge
Rules? I gotta read RULES‽
mbmbmbmbmb
Yep, aliases rock my world. Once one gets spam, note which store it was used for and delete. E-bay sellers are the worst "stores" - instant spam same day one of them gets my latest alias
1 
 Thumb up
 tip
 Hide
  • [+] Dice rolls
Guy Gifford
United States
Spokane Valley
Washington
flag msg tools
mbmbmbmbmb
So has anyone ordered from this store and have it shipped to the US. Is their shipping quote for the US too?

Their prices for the promo's are good and I want to order several, but I am concerned about shipping internationally on extra postage and fees.

 
 Thumb up
 tip
 Hide
  • [+] Dice rolls
Diane Close
United States
Saint Paul
Minnesota
flag msg tools
mbmbmb
douglasfir wrote:
So has anyone ordered from this store and have it shipped to the US. Is their shipping quote for the US too?


When you select a country for shipping, the price to that country is displayed in Euros. My order of promos cost:
Subtotal (just the promos/physical items in my cart): €16.00 EUR
Shipping and handling: €4.35 EUR

That's a total shipping and handling cost of 4.35 Euros to my USA address, for an order placed last November, with their new online storefront.
 
 Thumb up
 tip
 Hide
  • [+] Dice rolls
Guy Gifford
United States
Spokane Valley
Washington
flag msg tools
mbmbmbmbmb
pdclose wrote:
douglasfir wrote:
So has anyone ordered from this store and have it shipped to the US. Is their shipping quote for the US too?


When you select a country for shipping, the price to that country is displayed in Euros. My order of promos cost:
Subtotal (just the promos/physical items in my cart): €16.00 EUR
Shipping and handling: €4.35 EUR

That's a total shipping and handling cost of 4.35 Euros to my USA address, for an order placed last November, with their new online storefront.


Thanks for your reply.

Looks like I will be ordering some promo's. Been wanting these for awhile.

Shipping is very reasonable. How long does it take to get?
 
 Thumb up
 tip
 Hide
  • [+] Dice rolls
Diane Close
United States
Saint Paul
Minnesota
flag msg tools
mbmbmb
douglasfir wrote:
How long does it take to get?


Once it ships, it takes between 9-14 days to arrive. Note, however, it usually takes Repos/Sombreros 2 additional weeks from the time you order until the time they actually ship your order. So count on it being in your hands 3-4 weeks after you place the order.
1 
 Thumb up
 tip
 Hide
  • [+] Dice rolls
jamuki (Jueguetistorias)
Spain
Madrid
flag msg tools
mbmbmbmbmb
pdclose wrote:
I should also point out, that the fact that they email passwords to users means that they are likely storing your password in plaintext, unencrypted. So do not reuse a password you've used anywhere else to access the site, make sure it's unique. (That's just good security practices advice in general. In 2016, you really shouldn't be reusing your passwords on any sites.)


Hi Diane,

Very good tips. A little bit of nitpicking, feel free to ignore it

They do not store the password in plain text, rather they send the mail at account creation and then stored the password in the database with an encryption. However, I still consider it a bad practice.

Apart from this bad practice, however, they are using PrestaShop, which has some other, even worse bad practices (which I believe they are not fixing).

First of all, the hashing algorithm (in plain language, the """encryption""") is MD5, which is very bad. Second, they are using exactly the same """encryption""" for every user (when the normal thing is to add something specific to every user - ie, "salting" - see https://en.wikipedia.org/wiki/Salt_(cryptography)).

This was reported in this bug and has not been yet fixed.

It's not than an attacker will be able to discover your password, but they will be able to generate something that the system will believe is your password, so in a PrestaShop run store, I'd always use paypal and never store credit card info.

For more info on this specific topic, I recommend this webpage
3 
 Thumb up
1.00
 tip
 Hide
  • [+] Dice rolls
Front Page | Welcome | Contact | Privacy Policy | Terms of Service | Advertise | Support BGG | Feeds RSS
Geekdo, BoardGameGeek, the Geekdo logo, and the BoardGameGeek logo are trademarks of BoardGameGeek, LLC.