News for hackers. Stuff that matters.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by boingy on Monday October 14, 2013 @04:37PM (#6549477)
I've seen this on quite a few websites that use paypal. If you have ever come across a site that has a 'You are now being redirected to Paypal, please wait' page inbetween the checkout and paypal then you will probably see something similar if you quickly hit ctrl+S.

It doesn't help that Paypal themselves (https://cms.paypal.com/uk/cgi-bin/?cmd=_render-content&conte...) have tutorials with lines like: <input type="hidden" name="amount" value="15.00">

Re:Purchasing a £30,000 numberplate for the price of a bus t... by TomGullen on Monday October 14, 2013 @05:00PM (#6549612)
Some sites that use Paypal also have a form field for where to direct to upon successful purchase. Sometimes this page has a link to download the product you're meant to be purchasing.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by eterm on Monday October 14, 2013 @06:56PM (#6550208)
PayPal tell you to check when you get the payment confirmation through to check the checkout ID against your own records for what the transaction should have been, but I have fixed just such vulnerabilities in my work before.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by MichaelGG on Monday October 14, 2013 @05:49PM (#6549866)
But when they redirect back, isn't easy to verify the transaction?
Re:Purchasing a £30,000 numberplate for the price of a bus t... by kordless on Monday October 14, 2013 @04:26PM (#6549416)
The fact the hidden fields can be populated on a POST doesn't necessarily imply they are used on the backend. There's a plate ID field in there...which may or may not indicate there is a record for this transaction in a database.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by mortice on Monday October 14, 2013 @05:21PM (#6549722)
The fact that the author was able to manipulate values 2 pages after the form he modified pretty strongly implies that those values were used on the backend, however.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by biot on Monday October 14, 2013 @07:14PM (#6550291)
And once you're in prison for fraud, you can even make a small wage from manufacturing license plates. Win-win!
Re:Purchasing a £30,000 numberplate for the price of a bus t... by pbreit on Monday October 14, 2013 @05:44PM (#6549837)
This is how PayPal has worked for over 10 years. It's not that big of a deal. Tampering with the form fields is discouraged both by law and by the ease of confirming either programmatically or manually.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by BoppreH on Monday October 14, 2013 @04:58PM (#6549601)
Their Acrylic plate upsell is using a pretty dark pattern.

It's labeled "Uncheck this box if you DO NOT require a set of Acrylic Number Plates" and comes pre-checked.

Re:Purchasing a £30,000 numberplate for the price of a bus t... by elemeno on Monday October 14, 2013 @06:08PM (#6549956)
It's not really a dark pattern when the Acrylic plate is the product that most people are trying to buy - without it you don't have the physical numberplate you can put on your car.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by corin_ on Monday October 14, 2013 @06:49PM (#6550134)
Plus they make it pretty clear what the tickbox is, on top of the fact that an upsell of £20 for a physically made product on top of £30k for a license is the least useful upsell in the history of selling.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by sarreph on Monday October 14, 2013 @04:07PM (#6549307)
If the transaction went through and they unknowingly delivered the number-plate, would this be illegal? Or would it have to be resolved as a civil matter? [in the UK]
Re:Purchasing a £30,000 numberplate for the price of a bus t... by orf on Monday October 14, 2013 @04:11PM (#6549342)
I'm almost certain this would be illegal, as well as a breach of the computer misuse act. I've been wondering this myself though - it would have been cool to stick that plate on my car.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by sarreph on Monday October 14, 2013 @04:18PM (#6549371)
Shame, then. My thoughts exactly!
Re:Purchasing a £30,000 numberplate for the price of a bus t... by dragonwriter on Monday October 14, 2013 @05:04PM (#6549635)
By "illegal" do you mean "criminal"? Because a wrong that is redressable through civil rather than criminal process is still illegal under the normal definition of the word.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by rmc on Monday October 14, 2013 @04:31PM (#6549438)
Probably. Fraud is when you mislead someone and you make a benefit. And that's criminal, not civil.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by next89 on Monday October 14, 2013 @04:56PM (#6549592)
But if you use it for yourself and you pay a fair amount, say production+shipping+administration, you are not really making a benefit.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by tempestn on Monday October 14, 2013 @05:36PM (#6549801)
Say a store has a stereo on sale for $300 and you decide that since the wholesale price was only $120, a fair price would be $150. You're saying as long as you plan to use it personally, you could lay down three fifties and walk out with it without 'benefiting'? Your benefit in that case would be the $150 you avoided paying.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by rmc on Tuesday October 15, 2013 @06:07AM (#6552397)
You get the licence plate. That's the benefit. You didn't have it before, you have it now, it's something someone (incl you) value. "benefit" doesn't mean "profit".
Re:Purchasing a £30,000 numberplate for the price of a bus t... by jdmitch on Monday October 14, 2013 @04:02PM (#6549278)
I think you'll find bus tickets have gone up to £2.40 in London now ;)
Re:Purchasing a £30,000 numberplate for the price of a bus t... by koyote on Monday October 14, 2013 @04:06PM (#6549301)
If you're paying cash, why would you pay cash? It's £1.40 with an oyster card or a contactless bank card.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by orf on Monday October 14, 2013 @04:08PM (#6549315)
Here in sunny 'ol Hull its only £1.50 :)
Re:Purchasing a £30,000 numberplate for the price of a bus t... by chm on Monday October 14, 2013 @04:15PM (#6549356)
How much is a monthly pass for the tube + bus?
Re:Purchasing a £30,000 numberplate for the price of a bus t... by sarreph on Monday October 14, 2013 @04:20PM (#6549392)
I'm an undergraduate, and a student oyster monthly pass is just shy of £90 — It's more like £120 for an 'Adult'.

Pretty ridiculous that they don't subsidise essential things like these more, for students, as the cost of living here is already so stupidly high.

Re:Purchasing a £30,000 numberplate for the price of a bus t... by cperciva on Monday October 14, 2013 @04:49PM (#6549549)
Pretty ridiculous that they don't subsidise essential things like these more, for students, as the cost of living here is already so stupidly high.

Maybe they'd prefer to have students living somewhere else?

Re:Purchasing a £30,000 numberplate for the price of a bus t... by orf on Monday October 14, 2013 @04:54PM (#6549571)
Why would they want that?
Re:Purchasing a £30,000 numberplate for the price of a bus t... by rayhano on Monday October 14, 2013 @05:13PM (#6549678)
Because higher education is over subsidised and under performing. It's nice to get so much loan and grant money for a few years of dossing.
Re:Purchasing a £30,000 numberplate for the price of a bus t... by coherentpony on Monday October 14, 2013 @06:45PM (#6550121)
>It's nice to get so much loan and grant money for a few years of dossing.

Blanket statements like this make my blood boil. I worked incredibly hard for my education. And, when I did it I thought it was expensive. Since I graduated the UK government tripled tuition twice in four years. To be precise, the UK government allowed universities to triple tuition twice in four years. And believe me, most if not all of the universities in the Russell Group did indeed triple their tuition fees. The students that get the student loan help from the government now may be potentially facing a lifetime of debt, unable to pay off their loans before they retire. "Great," I hear you say, "When you retire, your student loan is written off." While at first glance this may seem appealing, it's bad for the economy. The UK government made a move that works well for them in the short-term but works out extremely poorly in the long-term. And this is not accounting for the fact that the average student graduating nowadays with about 9 times more debt. I don't know which country you are from or where you were educated, but in the UK where there are almost no scholarships for higher education, graduating with £30,000 of debt must feel pretty debilitating.

Oh, and by the way, there is no 'grant' money for students. Grants where for the education of yesteryear, when students didn't have to pay back the help they received from the government. It's depressing to think that the mere accident of the year of one's birth provides an entire lifetime of debt.

Re:Purchasing a £30,000 numberplate for the price of a bus t... by rayhano on Tuesday October 22, 2013 @03:59AM (#6590365)
Then you're over-thinking it.

The 'fees' are differed on the off-chance you don't earn a reasonable salary. You can call it debt, but it isn't. In the US they have real student debt that is debilitating. In the UK, it doesn't even register on your credit score.

Why is it that a school-leaver gets little to no help, and a university student gets a whole tonne of grants and deferred fees? Doesn't that inequality make your blood boil?

Details on UK higher education grants and deferred fee payments here: http://www.slc.co.uk/services/higher-education/grants-for-li...

And don't be melodramatic. It's not a lifetime of debt because there is a time limit and then the deferred fees are written off.

Re:Purchasing a £30,000 numberplate for the price of a bus t... by lmm on Monday October 14, 2013 @07:22PM (#6550326)
Then why does startup advice emphasise the importance of being based in a university town?
Re:Purchasing a £30,000 numberplate for the price of a bus t... by StavrosK on Monday October 14, 2013 @07:48PM (#6550429)
It was around 40 quid when I lived there in 2009. I was just about to get a 6-month pass because I figured it was worth it with my usage, then prices nearly doubled a few days before I came back from my Christmas holidays.

TL;DR: It used to be much cheaper, then they raised the prices.

Re:Purchasing a £30,000 numberplate for the price of a bus t... by kamjam on Monday October 14, 2013 @05:01PM (#6549620)
It depends, the London transport network is priced according to which zones you want to travel within.

http://www.tfl.gov.uk/tickets/14416.aspx

Re:Purchasing a £30,000 numberplate for the price of a bus t... by hbbio on Monday October 14, 2013 @05:19PM (#6549712)
In other news, you could purchase a $200k Banksy for $60: http://www.banksy.co.uk/2013/10/13/central-park

And you could have gone up to the end of the buying process...

Re:Purchasing a £30,000 numberplate for the price of a bus t... by umsm on Monday October 14, 2013 @04:40PM (#6549512)
These types of errors / issues / design choices are more common than you think. You'd be very surprised, but you can even see it on major sites.