4 ms·
You and gabbo are right. It's not necessarily the case the password is stored in plaintext. I'll update my post. However, stored in plaintext or stored in an e
by jerrya 15y ago
You and gabbo are right. It's not necessarily the case the password is stored in plaintext. I'll update my post.
However, stored in plaintext or stored in an encrypted, reversible manner, the password is not stored in what most folks would consider a secure manner.
Mav, the individual I chatted with, was able to quickly get my password. So could other customer service agents. So could any crackers they speak who then know that Newegg is a ripe and juicy target.
I'll respectfully disagree that there is any reason for Newegg or anyone else to keep that password in a reversible manner.
- 16s 15y agoThe thing is, we're not "most folks" (as you say). We understand, and it bothers us. However, "most folks" don't care and use the same password "Letmein!" for every website they visit.
- kelnos 15y agoThe fact that "most folks" don't recognize the poor security isn't very relevant; it's still poor security. And supposing most people do use the same password for most or all websites they visit, that makes it even more important that sites don't store their passwords in cleartext or in a reversible manner.
- tzs 15y ago> However, stored in plaintext or stored in an encrypted, reversible manner, the password is not stored in what most folks would consider a secure manner Credit card numbers are stored in a reversible encrypted manner, and that's considered good enough, so one might argue that it is good enough for passwords too since a leaked password is usually not as bad as a leaked credit card number. (I'm not necessarily endorsing that argument--just tossing it out for discussion).
- Johngibb 15y agoThere are very strict rules for what can be stored about a credit card. Specifically, I'm pretty sure that no one is allowed to store the card verification number. And even just storing a credit card in the first place is highly regulated. Here's more about PCI compliance: http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...