[FD] CompTIA Security+ and its insecure support system

[<user09990@xxxxxxx>]

I was signed up CompTIA account with a fake name for a privacy reason. Later 
on, I wanted to update my name in CompTIA account because I was planning to 
take their Security+ certificate. The problem is I cannot update my name 
directly from the profile menu, it told me to create a support ticket (this is 
a good idea I guess).  However, the support guy asked me to upload a copy of a 
legal ID (driver's license or passport) to the support ticket system.

The real bad thing is the CompTIA's support ticket system can be logged in by 
using just an "email address".  If you know email of someone who holds a 
CompTIA certificate, you can freely access his/her support tickets at:

http://newsupport.comptia.org/ics/support/mylogin.asp

You can fill anything in  'first name' field. Only a valid email address is 
required to access anybody support ticket.

So I tried to explain to them that this is not a good security practice to ask 
me to upload my passport to such an insecure system but the support guy cannot 
do anything about it.

I think the Security+ certificate creators need to learn how to secure a system 
containing sensitive information like the copy of customer's passports with at 
least a pair of username and password.

rgds,
CISSP wannabe

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/