MaxMind

[gsgkenny]

So, for as long as I have been using EJ there has been a "Slam the Online Scam" button on most all pages. Yet, EJ does less than nothing to stop scams / phishing / etc. I say less than because of the EJ emphasis on PayPal, which inadvertently practically promotes scams. Call it extremist if you will, but if you check trustlink (a BBB site) there are over 200 reviews about it. Mainly people getting ripped of by PayPal itself. But, if you consider that BBB is a US/CA service and PayPal is global, and that it doesnt account for the lack of anti-fraud gates, or the amount of daily phished accounts, you start to realize a bigger picture.



Anyways, there is this awesome service called MaxMind that checks the buyer information against other details, such as IP geolocation, and produces a risk score for the likelihood that the purchase is fraudulent. It also checks if the buyer is using a proxy / VPN and within its own system; you know, the stuff EJ could do but doesnt.



So my question is, why is this not an EJ additional feature? I am guessing one of three possibilities:

We'll look into it if we ever put the new site up.

It costs a lot to pay the programmers.

We are looking for something that is accepted globally.



Since its not about a payment processor, my guess is no. 1.

[E-junkie_Guru]

Thanks for bringing MaxMind to our attention; I'll refer that to Development for consideration. If it requires any seller-configurable settings at our end, implementing it would need to wait until we have the new Admin is completed, since the current Admin can no longer be modified without breaking it in unpredictable ways (hence our reason for building a new Admin in HTML that can be modified more readily).

[gsgkenny]

I knew it was option one!



Anyways, keeping with this security thing. For whatever reason my password did not work earlier. I reset it, and emailed support asking if there was an IP log. Nope... In all seriousness, my sites accounts are near useless. I use them simply to gate customers, but I keep an IP log. I think it would probably be a good idea to track password changes and IP addresses for situations where a merchants account could potentially be compromised.

[E-junkie_Guru]

Thanks, I'll also refer that suggestion to Development.



At present, we only log the last login IP for each account, so if you find yourself unable to log in and suspect unauthorized access, contact us first to ask what IP last logged into your account, instead of resetting your password to log in right away and then asking us about it later.



Also, the most likely method of gaining unauthorized account access would involve hacking your Login Email's inbox account first, so they could use Forgot Password to have a reset-link and temporary password sent there, after which they'd delete those messages to cover their tracks. For this reason, it's a good idea to maintain a Login Email which differs from the Display Email we show to your buyers (so crooks won't know which email inbox to hack for your login), and to change your email password whenever you can't log in and need to use Forgot Password yourself if your expected E-junkie password didn't work.

[gsgkenny]

Im more concerned that my PC was compromised than my EJ account in all honesty. If someone managed to access my account they didnt change where payments are sent. My codes are stored in my sites database and set to generate keys, and they cant access that via my email. I ran my scans and came up STD free, but then again my battle.net account was accessed via some dormant, hidden malware that even masked the true domain that I had to have logged into.



Anyways, I will take that advice and use separate addresses.

[keith]

When is this new admin going to be ready?



We already are using maxmind on one site and haven't had any fraud yet, and we want to increase marketing / traffic to increase sales on our E-Junkie site, but it takes a good amount of loss from fraud already. So increasing sales will only endanger our Paypal account since PP's fraud detection sucks (they blame the buyer for the charge back rate, not their own failure).



We need to be able to add Maxmind to minimize fraud and that would mean removing E-Junkie. We don't want to do that, but may be forced if we can't get an ETA on this.

[gsgkenny]

I prefer not to use PayPal for anything, and actually dont except for my E-Junkie subscription since they wont take anything else... But the openCart implementation is en route so I guess that is ok.



Anyways, check out Bitcoin. They are amazing and people are quick to support businesses who adopt them. Just let them know at bitcointalk.com and the reddit /r/bitcoin. No MaxMind needed for them; and honestly, dont hold your breath for upgrades and changes around here.

[keith]

Unfortunately, unless something has changed in the past year, PP was the only processor that works with the buy forms (not buy now), besides authorize.net. We have bitcoin on our other sites, but not enough people use it. We pretty much need PP with how many people use them.

[gsgkenny]

Have you came across Bitpay? They have plugins for openCart, Magento, ZenCart, and a few others. You can also fully integrate it into your site if you have (or are) a programmer. Coinbase is similar, though seem to have their fair share of issues that have hopefully been resolved by now, but also have Buy Now buttons. Both are 1% fee and can deposit local currency directly to your bank account rather than hold BTC.



Im sure you already know all that since your accepting with a few sites, but just thought I would mention it just in case. That and I really, really hate PayPal...

[keith]

Thanks, we do use bit-pay with Ecwid and WHMCS.



We also use 2ckeckout, but can't with E-Junkie either, although we are finding them even worse than Paypal unfortunately.

[keith]

Are openCart, Magento, ZenCart, or the others as simple as E-Junkie in that you can make buy forms (with drop downs and text input) and add and customize to your site? That's what I like about E-Junkie for this site. Had trouble finding a cart just as simple with more paypal processors and fraud protection.

[gsgkenny]

They are actually full websites, and I dont sell things with variations so Im not sure. Though, there are a million plugins for just about everything, so I am sure someone made one. Personally, I went with openCart because it seemed to have a little more of the things I liked and was a little easier for me to use. That and Magento is owned by eBay... But openCart comes with PayPal and MaxMind built in. Other payment processors usually cost a few dollars ($10-50) but it is a one time fee.



Here is my unfinished code delivery site: http://www.btc-gamecards.com/

[E-junkie_Guru]

Keith, we conservatively expect the new Admin to be ready within this year, optimistically by about the end of summer or so, if all goes to plan. I've already built the HTML/CSS templates for all the new screens but one, and the new developer we hired last year is writing the scripting to make it all dynamic and functional.



The trouble with implementing services like MaxMind is that they expect to be installed on the site where payments are being processed, so that would not be helpful for the vast majority of orders placed through our system, where the payment is handled independently of us on a third-party payment processor's checkout site, such as PayPal or Google Checkout. This might be feasible to implement for card-based direct payments using PayPal Advanced/Pro or Authorize.Net, which are handled on a secure checkout page we manage for you, though of course those payment gateways already have their own anti-fraud features built in (which are more sophisticated for PayPal Advanced/Pro than what's provided with PayPal Standard).

[gsgkenny]

Sorry, but that sounds like a bunch of shit.

Yes, it is true that it is better to stop the payment prior to processing rather than refunding later, but to suggest it cant be used a little ridiculous. It would not take much to allow users to select their acceptable risk level and when an order comes through above said chance for fraud E-Junkie automatically refunds the order. Its basic API functionality for all the payment processors. In fact, openCart is not a processor itself. It is a cart, just like E-Junkie. It seems to work fine for them.



I also find it really funny that you mention the PayPal "anti-fraud" features, you know, since he didnt post here saying he needed more fraud protection when using PayPal or anything... In fact, lets quote: "since PP's fraud detection sucks".



Finally, lets get down to the basic facts of life here. If a business does not adapt, it will die. I personally have been asking for more payment processors for years. I have mentioned more than one feature change; and looking through the forum posts, many others have as well. Lets list the significant changes that have happened:

1.

2.

3.

4.

5.



Oh, more versions of PayPal were added... I forgot... Rather than listen to paying customers, the only thing that ever happens is excuses followed by nothing. But that tends to be a recurring theme when a programmer try's to run a business.



Anyways, despite what my rough post makes this seem like, I am not out to sabotage E-Junkie. I admitted that I have been here for years, and when it comes to a "fat-free" cart, it kinda gets the job done. It is crystal clear that A LOT more could be done while still taking that same position, but if your looking to use the most basic of payment gateways and just add buttons to things, EJ is perfect. I am only taking a hostile position because I am tired of asking for things that should not have to be asked for, or change the entire backend structure of my almost totally passive small business. That, and you really did just try to feed him a large spoon full of bull shit.

[gsgkenny]

My last post was shortly after I got out of the car from driving a solid 16 hours with screaming kids and a dog. Now that I put 30 seconds of thought into your post, I realized a few things.



First, ACH payments are a two part process, authorize and capture. While I am not 100% certain, I believe that Google Wallet (Checkout) does not automatically charge the order. Therefore, it is entirely possible to implement MaxMind at the very moment it should be. I highly doubt this is possible with PayPal due to the way payments are processed with them, however that same circumstance makes it less of a necessity to implement at exactly that layer.



Then when you said "I've already built the HTML/CSS", you forgot an X and a 3. So now I wonder, IF the new UI is ever actually implemented, is it still going to be years behind the rest of the Internet?



Finally, when I said there were no changes I was wrong. You did add the totally useless social buttons to every page...

[E-junkie_Guru]

Google Checkout (the service used by merchants to accept Google Wallet payments on the Web) works as a "middleman" payment processor like PayPal, not as an ACH-style payment gateway -- i.e., the buyer pays the payment processor, which takes a cut as a transaction fee and then credits the remainder to your balance with that service, rather than an ACH direct payment where the buyer pays directly into your merchant account bank balance.



The only ACH-style payments supported by our service would use Authorize.Net or PayPal Payments Pro/Advanced/Payflow Pro (and the latter still allow for a PayPal account-based checkout option), and these are handled on a secure checkout page that we manage in common for all our merchants, which tends to throw a wrench into any solution that requires a checkout page on the merchant's site/domain or otherwise under the sole control of that merchant.



With both PayPal and Google Checkout, once the buyer clicks that checkout button in their cart, we hand off their cart details to the payment processor, where actual payment is arranged completely outside of our influence. When the payment processor completes their processing of the buyer's payment, they transmit the order details back to us in a completed payment notification (e.g. PayPal IPN), so we can process that order for you.



Our current, Flash-based Admin has become too complex and crufty to modify without breaking it in unpredictable ways, so any new features or functionality that would need new settings to manage them have had to wait for an all-new Admin that we can actually modify; therefore, completing that new Admin has been our penultimate Development priority (behind maintaining our current system, of course).



Adding support for PayPal Advanced and Payflow Pro was pretty much a matter of PayPal twisting our arm; we had little choice in the matter if we wanted to stay in PayPal's good graces, and the way we had to go about adding settings for them was, frankly, a rather clumsy stopgap that will finally be properly integrated in the new Admin.



HTML and CSS are generic terms covering HTML v.1-5/XHTML and CSS1/2/3/4 respectively. XHTML is not a successor to HTML4, which would be HTML5 (currently still in development); XHTML is a fork of HTML that also complies with the XML standard, intended for use in special cases where HTML also needs to be processed by XML software tools. Our new Admin code will not need to interoperate as XML, so I'm avoiding the unnecessary code bloat of XHTML by building it in HTML4 that will also be valid HTML5 (insofar as the latter standard has been developed so far).



Finally, bear in mind that E-junkie is deliberately positioned as a simple, basic, reliable solution for simple, basic needs. We cannot be everything to everyone, and trying to become that would turn us into the sort of sprawling, bug-ridden bloatware that nobody wants -- indeed, the very sort of thing we were created as an alternative to. There's a plethora of all-singing, all-dancing ecommerce platforms already competing out there, so we're not even trying to compete with them on their terms; we're going for the under-served demographic that finds such solutions to be daunting overkill, yet who don't want to be captive to a marketplace site like Etsy, eBay, or Amazon.



We are like a VW bug -- simple, basic, reliable and easy to maintain yourself; if your business has grown to the point that what you really need is more like a cargo truck, you'd do best to just get one of those, rather than expecting VW to trick out your bug to be more like the truck you actually need.

[gsgkenny]

I was so happy to see a reply with more than a few sentences.

Anyways, the XHTML and CSS comment was me being a smart ass; same as the social buttons comments. But back to the point, pretty much everything uses ACH payments online, and my comment wasnt intended to suggest literally getting between the processes of an ACH transaction. Because truthfully, while it may not be ideal, it is more than possible to add a layer of protection for merchants by adding MaxMind. Less than perfect is better than the present.



I also understand catering to a niche market, and I get the goal is not to become like all the others out there. What I wonder is where that niche market operates? The only way to list EJ buttons on eBay and follow the rules is through Information Products > Classified Ad. Which is a $10/mo local ad that if listed on .com will not show on any other eBay site. And to be honest, the rules about classified ads are fuzzy at best and EJ buttons might not even be allowed there. Or is the goal blogs? Because Im pretty sure that wooCommerce kinda took over the blog / ecommerce platform. There is no way in hell EJ is operating on Facebook, though that could / would have been a hell of a market to peg as it arrived and still maintained the "fat-free" goal. So what about the build your own site people who do things more as a hobby (like me)? I guess that is something... But I would think those who are serious about building / having a site built from scratch either know what they are doing enough to implement an API, or will at the least, hire someone from elance for $1k to build the entire site. There is also all those ebook sellers that have single page websites that are 5k px long and say BUY MY BOOK 82 times.



Anyways, there is still a lot that could be done without adding bloatware. More payment processors doesnt bloat anything, but it does allow merchants to reach more customers and use more favorable payment solutions. Adding MaxMind doesnt bloat, it protects the merchants from fraud. Something I imagine most would prefer and should probably be considered at the ethical level by EJ. Plus, it has the potential to add another revenue stream through affiliate sales. In fact, I cant think of anything I have ever mentioned as an improvement that should be considered bloatware.



Back to the cart discussion, whether you like it and want to admit it or not, you are competing with openCart, ZenCart, wooCommerce, and the entire plethora of other carts. Maybe not on "their terms" as in offering full cart solutions, but you are competing none the less, and I would assume losing. I also find it ironic that you mention being captive to a marketplace, when EJ is in fact captive to PayPal.



But truthfully, I really dont care and even continuing to post is a waste of my time. I could be spending time with my family, studying for an MBA, doing more for my Army unit, transitioning my sites to openCart, or maybe even the crazy watch TV. Instead I am arguing a lost cause in my spare time... There are a hundred things that you could have (and could still) do to improve this service. But the truth is, this is probably just as passive of a business as my own. There is no ambition or desire to change anything, or make the service better. It is what it is and that is what it will stay.

[fraudoracle]

E-junkieGuruThanks for bringing MaxMind to our attention; I'll refer that to Development for consideration. If it requires any seller-configurable settings at our end, implementing it would need to wait until we have the new Admin is completed, since the current Admin can no longer be modified without breaking it in unpredictable ways (hence our reason for building a new Admin in HTML that can be modified more readily).

From the Company: If you can, we’d like to see what you think of our new system by Fraud Oracle. It was developed over several years, and it’s showing to be very accurate from initial deployments. We’ve also made it very developer friendly to implement – the docs are on the Fraud Oracle website. There’s a free trial as well, to try it without cost.



Thank You,

Fraud Oracle