6 ms·

First, the level of technical incompetence is staggering: * Two significant breaches in 7 months * Bank/CC and personal details stored unencrypted * Psssword

by scoot 11y ago

First, the level of technical incompetence is staggering: * Two significant breaches in 7 months * Bank/CC and personal details stored unencrypted * Pssswords stored in cleartext * "We have taken all necessary measures to secure the website." That's what they said last time. Second, the response is laughable: * Two days since the breach was discovered, and customers still haven't been notified. * No mention of the breach on the talktalk.co.uk home page. * The site in question [1] says it is offline due to an attack, but doesn't like to the relevant help page [2] [1] https://myaccount.talktalk.co.uk/ https://myaccount.talktalk.co.uk/ [2] http://help2.talktalk.co.uk/oct22incident http://help2.talktalk.co.uk/oct22incident

robmcm 11y ago
The number of sites that have flaws like you mentioned (encrypted data and clear text passwords) is worrying. Is there not a independent third part that can audit sites for this kind of incompetence and rank or award compliant sites so consumers can factor this in when choosing services?
- madaxe_again 11y ago
  Yes, PCI QSAs. All they can do, and all the ICO can do, is fine you. A typical fine might be £10k-£100k. For these large businesses, they see it as being more cost effective to be cavalier about security and pay off the authorities. See amazon's credit card handling, for instance. Like most things in life, it's a two tier system.
- Benichmt1 11y ago
  There's this site which acts as a 'wall of shame' for blatant violations of storing passwords in plaintext - http://plaintextoffenders.com/ http://plaintextoffenders.com/ Not sure if it's actually effective at getting things done but certainly is a nice reminder for the consumer to be careful.
7952 11y ago
>> We have taken all necessary measures to secure the website It is probably wrong to read too much into the wording. But it is jarring when a company of this size presents their website as if it is external to the rest of their operations.
- tome 11y ago
  Yes, it sounds hilarious to me, but I think it says more about the technical knowledge of the population they are trying to communicate with than TalkTalk's own technical knowledge.
konceptz 11y ago
This work doesn't provide a direct audit for websites but it does measure software security at organizations. https://www.bsimm.com https://www.bsimm.com
oneeyedpigeon 11y ago
"Password stored in cleartext" - wait, what?! Where have you seen a reference to that?
- scoot 11y ago
  From the help page: "TalkTalk will also NEVER Send you emails asking you to provide your full password. We will only ever ask for two digits from it to protect your security." AFAIK, you can't verify two randomly selected characters to a hashed password. My bank is also guilty of this. Edit: direct evidence from TalkTalk: https://twitter.com/TalkTalkCare/status/514417284560191488?ref_src=twsrc%5Etfw https://twitter.com/TalkTalkCare/status/514417284560191488?r...
  - donnycantdance 11y ago
    You can achieve this by hashing all the possible combinations that you could ask for with a salt and store those.

by scoot 11y ago

robmcm 11y ago

The number of sites that have flaws like you mentioned (encrypted data and clear text passwords) is worrying. Is there not a independent third part that can audit sites for this kind of incompetence and rank or award compliant sites so consumers can factor this in when choosing services?

madaxe_again 11y ago
Yes, PCI QSAs. All they can do, and all the ICO can do, is fine you. A typical fine might be £10k-£100k. For these large businesses, they see it as being more cost effective to be cavalier about security and pay off the authorities. See amazon's credit card handling, for instance. Like most things in life, it's a two tier system.
Benichmt1 11y ago
There's this site which acts as a 'wall of shame' for blatant violations of storing passwords in plaintext - http://plaintextoffenders.com/ http://plaintextoffenders.com/ Not sure if it's actually effective at getting things done but certainly is a nice reminder for the consumer to be careful.

7952 11y ago

>> We have taken all necessary measures to secure the website It is probably wrong to read too much into the wording. But it is jarring when a company of this size presents their website as if it is external to the rest of their operations.

tome 11y ago
Yes, it sounds hilarious to me, but I think it says more about the technical knowledge of the population they are trying to communicate with than TalkTalk's own technical knowledge.

konceptz 11y ago

This work doesn't provide a direct audit for websites but it does measure software security at organizations. https://www.bsimm.com https://www.bsimm.com

oneeyedpigeon 11y ago

"Password stored in cleartext" - wait, what?! Where have you seen a reference to that?

scoot 11y ago
From the help page: "TalkTalk will also NEVER Send you emails asking you to provide your full password. We will only ever ask for two digits from it to protect your security." AFAIK, you can't verify two randomly selected characters to a hashed password. My bank is also guilty of this. Edit: direct evidence from TalkTalk: https://twitter.com/TalkTalkCare/status/514417284560191488?ref_src=twsrc%5Etfw https://twitter.com/TalkTalkCare/status/514417284560191488?r...
- donnycantdance 11y ago
  You can achieve this by hashing all the possible combinations that you could ask for with a salt and store those.