Tesco say website and app down after hack attempt | Hacker News Reader

Tesco say website and app down after hack attempt

bbc.com

33 pointsreallydontask16 comments

In 2017 I found a security issue with the Tesco website. It was a minor security issue, but I could see they had _attempted_ to stop people doing what I could do.

I did manage to find an email address, but I got a templated response, and when I checked a year later it was still not fixed.

Sure, it was a minor issue, but I was surprised Tesco didn't have a proper Vulnerability Disclosure Program or Bug Bounty program. A bug bounty program is an inexpensive way to avoid exactly this sort of issue.

Their site is in a weird state at the moment. The homepage looks normal, and some of the category pages do too.

But I get errors on pages like these:

https://www.tesco.com/groceries/en-GB/zone/pharmacy ("Sorry, there's currently an issue on our website.")

https://secure.tesco.com/clubcard/ ("Your browser has failed some security checks" - Lol...I don't think my browser is the issue)

The BBC really seem to be scraping the bottom of the barrel with their reporting. This really affects thousands of people all of whom couldn't care less what Chris Hodgson (bless him) thinks of the level of customer support that has been provided to him today.

It's the hack which is the newsworthy part, not the outage.

I think OP was complaining about the vox pop rather than the report of the hack or outage (which is newsworthy)

It’s safer as a news writer to report “X says Foo” rather than “Foo”. It’s a sad reflection of the times.

Even accepting that though, They could have stated “there were anecdotal reports of outages over the last few days” (I wouldn’t personally as it’s just hearsay), but there is a belief (presumably backed by some research) that people like “human elements”. I certainly don’t, but I’m not normal.

Additionally, by mentioning a shithole like Stoke (my local city) it also helps convey the idea that the BbC isn’t just a London organisation for London people, and is relevant to C2DEs. Again I’m not convinced, but I can appreciate the problem the BbC has.

This doesn't surprise me, their online platform feels like one big sticking plaster. They've had previous problems with clubcards (reward cards) being hacked and pretty much blamed the users...

I'm an online Tesco shopper, usually using "Click and Collect" because the shop is only a 3 minute drive away.

Point is, I use the app and/or website every week - both are pretty awful, but the website is the worst.

Main pain point is it's just so slow - you search for something and it takes seconds to show the search results, then you click to add something to your basket and it takes seconds to do that too, and occasionally it fails silently. A few seconds might not sound like much, but if you want to add dozens of items it's really frustrating.

Then there is the search function, which is absolutely rubbish - you apparently have to know what secret-squirrel keywords are bound to each product. For example, if I search for "seeded bread", the particular brand I want doesn't show up, same if I search for "Hovis seeded"; but if I search for "Hovis seeds", then it finds it. So if you can't find something, you're never really sure if they don't have it, or you just can't find it.

Another gripe with the search function is that results aren't ordered as you expect. Tesco has a "favourite" tag applied to things you've purchased before, so you'd expect "favourite" products to be shown first - nope.

Which brings me on to the "favourite" feature - if you buy something just once, it gets tagged as a favourite, and there is no way to manually tag or untag products. So it could be there is a product you really didn't like, but it shows as a favourite for months afterwards.

Then there is product reviews, which AFAICT aren't shown in the app at all, only on the website. And they silently delete perfectly reasonable bad product reviews, which is just really shitty behaviour.

Also, the whole design and UX feel of the website is just... off. It really feels like a website created by junior devs in the 90's - ugly, slow, disfunctional and downright clunky.

The app is a lot faster in general than the website, but still slowel enough to annoy, and it lacks some features that are available on the website, such as reviews and "shopping lists". The checkout UX is horrible though, it feels like you have to slowly tap through too many screens, and you now have to enter your card CCV for every single change you make, which is irritating and yet another screen to slowly tap through.

With all the money behind Tesco, I really don't understand why their online shopping experience is so crappy.

> With all the money behind Tesco, I really don't understand why their online shopping experience is so crappy.

they probably prefer you coming through the door

This is really strange to read, as I think their online ordering website is great and simple to use.

> and you now have to enter your card CCV for every single change you make

That's only at the end. You can make a whole bunch of changes, then you enter in the CVV code.

Do we know for a fact it's a "hack attempt", whatever that means, or is it just a production problem which is all down to them?

It's clear Tesco thinks it's a hack and/or dos attempt...

"An attempt was made to interfere with our systems which has caused problems with the search function..."

Of course, we don't know what the problem actually is.

Tesco seem to be throwing everything at online shopping despite all signs indicating its never going to be profitable for them.

Why couldn't it be profitable for them?

Well they never give a profit breakdown in their results which suggests it isn't.

Also, paying someone to pick items off the shelf and paying another person to deliver the items to your home has a cost and that cost is not covered by how much they charge for service, which for regular subscribers is negligable.

The grocery market in the UK is highly competative and margins are quite low.

During the pandemic they massively ramped up home delivery and they made loads of money. They seem to be doing OK.

Tesco's share price has done well recently because of take-over speculation after the recent Morrison's buy-out. Other than this it's performed relatively poorly for the past 10 years.

As already mentioned, they don't publish seperate profit and loss figures for home deliveries. There is a good reason for this.

Reply on news.ycombinator.com