4 ms·

This is frightening. Who is running the security teams at these large companies?

sbarre 11y ago
You'd be surprised how often this happens. I had a similar situation with someone who accidentally used my email when buying a new car. For a while I was getting emails from the Hyundai dealership that had auto-login links that would have let me do all kinds of things, including requesting a (paid) tow of the car from my house back to the dealership, scheduling (or cancelling) maintenance, ordering extras and part, and more.. Luckily through that logged-in area I was able to find the individual's phone number and we texted back and forth until he understood the problem and called his dealership to update his info.
- hellofunk 11y ago
  This is genuinely amazing to me. And the IT guy that set up that Hyundai system is probably getting paid plenty to do it, despite massive flaws like this.
  - sbarre 11y ago
    I bet you someone somewhere is making a business decision to trade technical support costs for their customer's data security.. I bet this happens all the time.
Lawtonfogle 11y ago
Security is a cost center with no output and no drawbacks when you cut it (as the business people see it). So it is often quickly underfunded til some major incident.
- hellofunk 11y ago
  That's really strange, isn't it? Because it only takes one major incident for a company to go entirely out of business in many cases. Or for CEOs to get ousted or step down, as in the Ashley case, or any number of other irreversible catastrophes. It would seem to me security should be the most important part of the entire process.
  - SixSigma 11y ago
    Then the CEO blames the IT dept, shareholders lose their investment and CEO moves on to next job with the bonuses he got for cost cutting still intact.
    - hellofunk 11y ago
      You know what? Sometimes the truth hurts.
ssharp 11y ago
I find it hard to believe that they didn't know better. They were using 12 rounds of bcrypt to store the passwords, afterall. Assuming just the DB is compromised, they would likely be okay because of that. I'm not sure how often systems are so entirely pwned as to gain access to their source code repos and their entire production database. That seems like an outlier kind of attack, though I think the same thing happened with Sony. I don't think it's fair to say that this was a security oversight, so much as it was a conscience decision to make the system have less friction for users by utilizing these login tokens.

You'd be surprised how often this happens. I had a similar situation with someone who accidentally used my email when buying a new car. For a while I was getting emails from the Hyundai dealership that had auto-login links that would have let me do all kinds of things, including requesting a (paid) tow of the car from my house back to the dealership, scheduling (or cancelling) maintenance, ordering extras and part, and more.. Luckily through that logged-in area I was able to find the individual's phone number and we texted back and forth until he understood the problem and called his dealership to update his info.

hellofunk 11y ago
This is genuinely amazing to me. And the IT guy that set up that Hyundai system is probably getting paid plenty to do it, despite massive flaws like this.
- sbarre 11y ago
  I bet you someone somewhere is making a business decision to trade technical support costs for their customer's data security.. I bet this happens all the time.

Lawtonfogle 11y ago

Security is a cost center with no output and no drawbacks when you cut it (as the business people see it). So it is often quickly underfunded til some major incident.

hellofunk 11y ago
That's really strange, isn't it? Because it only takes one major incident for a company to go entirely out of business in many cases. Or for CEOs to get ousted or step down, as in the Ashley case, or any number of other irreversible catastrophes. It would seem to me security should be the most important part of the entire process.
- SixSigma 11y ago
  Then the CEO blames the IT dept, shareholders lose their investment and CEO moves on to next job with the bonuses he got for cost cutting still intact.
  - hellofunk 11y ago
    You know what? Sometimes the truth hurts.

ssharp 11y ago

I find it hard to believe that they didn't know better. They were using 12 rounds of bcrypt to store the passwords, afterall. Assuming just the DB is compromised, they would likely be okay because of that. I'm not sure how often systems are so entirely pwned as to gain access to their source code repos and their entire production database. That seems like an outlier kind of attack, though I think the same thing happened with Sony. I don't think it's fair to say that this was a security oversight, so much as it was a conscience decision to make the system have less friction for users by utilizing these login tokens.