6 ms·
I'm pretty amazed that in this day and age companies still store sensitive information like user passwords and credit card numbers in plain text.
by cheeky 16y ago
I'm pretty amazed that in this day and age companies still store sensitive information like user passwords and credit card numbers in plain text.
- coenhyde 16y agoIMO storing this kind of information in plain text was never acceptable. It requires the right combination of arrogance and incompetence for this to happen.
- mgkimsal 16y agoIn some ways it's no wonder POF was able to bootstrap and run this amazingly large system all written by one guy with limited hardware. Dunno what their stats (or headcount) are now, but years ago POF was heralded as some genius site because it was all put together by one guy and running on a few load balanced servers. I'm not saying it takes multiple people to make something secure, but if one person either doesn't have the experience or knowledge to make something secure, and there's only that one person, there's no one else to even determine there's a problem.
- getsat 16y agoThis appears, unfortunately, to be the norm and not the exception. It comes to mind every time I sign up on a new service. Obligatory: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- smokinn 16y agoNot only does POF store it in plaintext but they email it to you every few days when they send you their "new matches" email. So basically they're sending probably about 1/4 of their member base's passwords in the clear over the internet every day through those emails.
- rmc 16y agoI know how and why you should store hashed passwords, but surely you'd have to store credit card numbers in plain text? If you store a hashed credit card number, you'll be unable to charge it again? How do you use a hashed credit card number?
- aeontech 16y agoIdeally, you don't store credit card numbers at all. If you need to do recurring billing, there are platforms that will do it for you, otherwise, process the transaction and remove the number from your system. Storing this kind of info securely and in PCI compliance is not trivial, and takes engineering resources that are better used on something that will distinguish your product from competition.