Citizen’s Bank Online Gets Scary
December 22nd, 2005
When I recently went to citizensbank.com, instead of seeing their normal homepage as I expected, I saw this instead:
Needless to say, my confidence was a bit shaken. Here I was about to do a real transaction with real money, and I get the message that there is a “server error”. In addition to not understanding what went wrong, I’m left with absolutely nothing to do but come back later and retry.
This type of thing doesn’t happen all the much to me, but it does every now and again. And each time I’m left with a choice of whether to continue to use the service or to go elsewhere. It’s a choice that can only be bad for the company in question, and can only do harm to the relationship they worked hard to build with me.
However, I will say that as a web developer I can understand how this might happen. Files don’t always copy over the right way, someone else might have done something silly, or a new plugin fouled things up. A myriad of things might have been the bugaboo.
But on a banking web site? I think I’m once bitten, thrice shy.
Tweet
December 23rd, 2005 at 8:49 am
I have seen this error before too. I also do business with Citizens Bank and I also was concerned when I saw this error. Not to metion that this error gives a potential hacker some useful knowledge about the application which scares me a bit more. Thanks for posting this I am glad to see someone out there cares about this kind of stuff.
December 23rd, 2005 at 3:57 pm
I thought of you just now…I am having SBC problems and went to their system status page
http://csc1.sbcis.sbc.com/systemstatus/
and clicked on California and instead of any status I get a page of HTML (which of course I can’t really exactly paste here because it gets interpreted as, well HTML…something like this, then):
HTML
HEAD
META NAME=”ROBOTS” CONTENT=”NOINDEX, NOFOLLOW, NOARCHIVE”>
META HTTP-EQUIV=”Expires” CONTENT=”0″>
META HTTP-EQUIV=”Pragma” CONTENT=”no-cache”>
META HTTP-EQUIV=”Cache-Control” CONTENT=”no-cache”>
TITLE>SBC System Status: Summary
link rel=”stylesheet” href=”/systemstatus/css/status.css”>
script language=”javascript”>
function checkAll(){
for (var i=0;i
December 23rd, 2005 at 8:36 pm
I’d guess that this was due to their new site launching. It’s up now. Simply better efforts to launch off hours, with a page telling people the new site was coming would have avoided this problem and the reputational risk they have now to enjoy with your post.
December 25th, 2005 at 7:42 am
Btw, the same problem is on the msn.com at the Opera browser (at least version (7.23)[my favourite]…
December 25th, 2005 at 7:45 am
o, i’m sorry… not msn, but hotmail.com… SORRY
January 3rd, 2006 at 5:14 pm
@Joshua: The error you saw is a common ASP.NET error screen. It would be nice if a more friendly message was displayed when an error occurs though.
@Ron West: FYI – The error displayed doesn’t reveal anything about the server except that the site is built in ASP.NET….something a hacker probably could already tell by looking the file extensions (.aspx) on the rest of the site. I’m not trying to defend the appearance of the message, it should have been avoided.