In case you’re not aware, Pimax allows unthrottled public queries on their Check Your Order page without doing any kind of credential checks.
Once entered, the page lists your name , order details , full address , and phone number
…all in a neat pile of very much personally identifiable information essentially up for grabs with minimal effort (as in, I doxxed myself with a dozen lines of python. Just enter email and wait a minute.)
Note that changing your account details unfortunately does not affect the order details, so they’re available now and forever unless Pimax does something about it.
I have an open ticket with Pimax about the issue, but there’s not much hope there as the rep I got doesn’t seem to understand at all. ( “where you find this problem which I dont think so ?” )
Yeah really wouldn’t it be simple to check an order status with only entering order number? Otherwise to verify details login as said to see private details.
If a big star had their private discrete address made public…
The latest reply from support is only more ignorance on the matter:
“Your personal information will be kept strictly confidential. Please rest assured.”
This very assuring reply came after I explicitly demonstrated their site is leaking data like a sieve, but support still refuses to acknowledge the issue at all.
So if you have shared your email address with anyone, whether through PM or publicly, anyone who has it can view all your private info. This is not right Pimax, there is a BIG difference between sharing your email address and sharing your real first and last name and telephone number.
This system never gave me any info. The status was always blank then out of the blue I had an email with the tracking number. And yes, it was very late than Pimax implied in their order confirmation email. But the sad thing is that I feel that the staffs here are also stressed with the situation perhaps indicating that the individuals we deal with has no jurisdiction over solving the root cause.
I like the products despite the small quirks here and there so I really wish the company will fix their weakest part of the link.
