4 ms·
Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice. Try @briankrebs on Twitter.
by _Understated_ 7y ago
Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice.
Try @briankrebs on Twitter.
- btrettel 7y agoThere's a blog specifically dedicated to highlighting examples of plain text storage of passwords too: https://plaintextoffenders.com/ https://plaintextoffenders.com/
- wtmt 7y agoThis is the best way to go about it if people at the bank aren’t responding. Nobody likes a PR nightmare, and Brian Krebs can handle this better with the right people if the OP provides enough evidence.
- cpv 7y ago"Almost without fail at each engagement multiple C-level folks will approach after my talk, hand me their business cards and say something like, “I hope you never have to use this, but if you do please call me first.”" https://krebsonsecurity.com/2019/12/ciso-magazine-honors-krebsonsecurity/ https://krebsonsecurity.com/2019/12/ciso-magazine-honors-kre...
- Wheaties466 7y agoAlternatively I feel like Troy Hunt may also be able to help https://twitter.com/troyhunt https://twitter.com/troyhunt He runs the @haveibeenpwned service
- daveoc64 7y agoTroy has actually covered a similar topic to this in the past: https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/ https://www.troyhunt.com/banks-arbitrary-password-restrictio... His viewpoint seems to be that poor security practices around passwords in banks are not a big deal, due to the overall processes that banks use to prevent fraud.
- loeg 7y agoI would tend to agree, for now, except that banks are doing their best to shunt responsibility for fraud onto merchants and customers. There are obvious financial incentives that will encourage them to continue trying to do so.
- valtism 7y agoTroy is usually reeeaaally busy and he may not have time to jump on this one case.