Right so if you hash the order IDs you're not revealing them. So I know my order id, hash it, then find the hash in the page. Voila. I know where I am in the list but everything else is meaningless. Just an idea.
Should I have received my final order eMail already?
- Thread starter EvilDragon
- Start date
Until somebody looks it up in a rainbow table... Then you would need to salt the hashes and so on and so on. Who is going to put in that time and effort to implement that and make sure it can't be easily misused?
Total possible order ids is 26^10 which is 1.4e14 or 2^47. So no chance rainbowing that. Unless you crack EDs order id scheme and massively reduce the search space, which is what I'm sure you meant.
ED - how do you generate order ids?
ED - how do you generate order ids?
I could easily find rainbow tables for 10 digit lowercase alpha-numeric passwords so the search space is at the upper end of available rainbow tables but not impossible. I am a bit surprised though that the order id alone is enough to change order information, I usually wouldn't assume an order id should be kept secret...
ClockworkCoder
Chaotic Neutral
A lot of time has passed in this case. Many people will have moved, may have changed their name (got married), changed email address, etc... so it may be hard to guarantee legitimate ownership of a specific order without it.
Hmm true but I'd still think some more verification besides the order id would be good.
levi
Still fresh, damnit!
You can change the delivery address for your account there using just an password recovery address, but that won't affect the delivery details attached to your outstanding orders. Perhaps if you log in using your recovered password you might be able to edit the addresses there, I guess.
tnpir4002
Member
- Joined
- May 1, 2012
- Messages
- 34
- Age
- 39
What about something that's date-based--it would still be based on order numbers but those wouldn't be visible to anyone. You could simply say "we're working on orders that were placed on this date," and that leaves it to people to figure out when we ordered ours and get an idea where you are in relation to when we placed our orders. In theory that keeps order numbers entirely confidential and just outputs a list of dates. Then if I see that you're getting close to my order date then I'll know I can start getting excited! (Assuming you're going through them chronologically anyway, if not then this is a silly idea and I humbly retract it.)You're sending PMs / eMails every few days which I usually ignore as I already told you half a year ago when I had your Pandora here for the first repair that I'll let you know once I found the time to look at it and sending more mails won't speed things up.
It's the same thing yet again: Once I found the time to fix your Pandora, I'll let you know.
Please understand that fixing Pandoras is not part of the daily shop business. Orders are shipped out instantly by my employee, doing custom stuff like Pandora repairs is what I have to do myself, and I've got more than enough work on my plate now.
Sending tons of mails / PMs about the same thing simply is annoying and will slow things down even more.
About everyone else who tries to reach me:
Yes, using any of the instant messengers found on the DragonBox Shop page (lower right corner, chat symbol) is usually the fastest way to receive replies.
The thing is: These chats directly pop up on my smartphone, so I can quickly reply from anywhere I am, where everything else needs to be manually checked on my computer... that's the reason this is the fastest way.
Sorry about that, but with the amount of requests / mails / etc. I received these days, I could spend 10 hours a day responding to those... but I don't have that time
Post automatically merged:
The problem with that is that someone could just grab that order ID and inform me that his address has changed, effectively stealing a Pyra.
levi
Still fresh, damnit!
He already does that, see the OP (at time of writing it states that your order is valid if placed before 05/01/2016 00:36:54), and it even gives an order number for that time and date.
Bagpussawake
Member
Any more news on progress, the forum seems pretty quiet?
I haven't been on the forum for a while so only just found out there is an order status checker webpage. I haven't had an email but a quick check on my order number shows the my Pyra is ready to be shipped. I don't know how long it has been available for me to complete my order and if anyone is interested I pre-ordered on the 30th April. Looking forward to my parcel arriving in the next couple of weeks!
tnpir4002
Member
- Joined
- May 1, 2012
- Messages
- 34
- Age
- 39
April 30th of what year though? 2016?
levi
Still fresh, damnit!
I assume he's from the Americas. April 30th 2016 is the day before May 1st 2016, and the Pyra pre-preorders was opened at 12 midnight on 1st May 2016 CET. Anywhere with a time signature less than CET will find the opening pushing back into April 30th.
Silent-Hunter
Hardcore Member
- Joined
- May 29, 2010
- Messages
- 3,485
Wait what? I wanted one of those. How did I miss that? I indicated that I had wanted one in the poll or whatever it was.
- Joined
- Jan 18, 2010
- Messages
- 11,418
the Poll just gave general interest, my guess people who didn't see the poll ordered them when it was time to get their Pyra.
hns
Well-Known Member
Maybe here: https://shop.goldelico.com/wiki.php?page=Product&product=3031
But there are still to be solved issues with shipping within the EU (different sales tax per country and no really cheap shipments: placing goods in registered letter was forbidden a while ago).
Maybe ED could take remaining stock and do the forwarding.
And, if components are available (haven't checked), more can be built within 1-2 weeks.
EDIT: have checked - is difficult but doesn't look impossible at the moment.
Last edited:
Asaggynoodle
Long Term Lurker
Similar threads
