3 ms·
I have spent a long time in eComm in the west, and you see that kind of stuff there as well. The most erroneous was the company that would take credit cards in
by ehnto 5y ago
I have spent a long time in eComm in the west, and you see that kind of stuff there as well. The most erroneous was the company that would take credit cards in plain text, print them onto an order sheet for reception staff to put through their POS at the front desk, and then the order sheets just went into the bin near the entrance. Thousands of credit card numbers were just sitting there for the taking, in plain text, in plain sight.
- chefandy 5y agoIndeed, astonishing retail-level security shenanigans will happen anywhere relying on simple credit card numbers. That said, the attack surface of a piece of paper is vastly smaller than a web-app-connected database.
- fishtacos 5y agoNot quite as egregious, but when I worked in QA for an internally accessible, hospital record keeping web app, most of the "test" data was real customer data, and OBVIOUSLY I had complete access to prod with no particular oversight (although I'm certain logging was enabled) for HIPPA. Still, glad it was available, as going through approval processes would've been a nightmare for our implementations.
- Tempest1981 5y ago> going through approval processes would've been a nightmare So internal apps can skip the HIPPA approval process? Or everyone can?
- coldcode 5y agoThe healthcare place I worked (mid 00's) kept all the prod passwords in a text file accessible to half the company. No auditing of logins into those servers either, so who knows what was leaked.
- spookthesunset 5y ago> The most erroneous was the company that would take credit cards in plain text, print them onto an order sheet for reception staff to put through their POS at the front desk, and then the order sheets just went into the bin near the entrance Back in my younger days, I've implemented exactly such a system. Looking back, it seems like a "WTF where you thinking" but somehow it made sense back then. What is obvious practice now took 20+ years of internet evolution to reach. I've also worked for companies that: - Stored user passwords in plaintext so you can email the customer their password if they forgot - Stored the CVV so "we could issue refunds" - Accidentally created anonymous email relays using copy & paste code from some "how do I create a webform in PHP" site. - Test data was simply a mirror of production - Test servers would send real emails to real customers (because the test data was a prod mirror) There are probably some other atrocities I've been exposed to but those are the highlights. Oh yeah, forgot one: - To "save money" on hard drives for "the server" we did a RAID0 array. Works great until one of the disks die and you loose everything. (This was my own dumb fault though). Live and learn I guess!
- yibg 5y agoNot just ecomm. I remember the days when customers would read their credit card numbers over the phone for small businesses (e.g. pizza joints). You'd write it down for processing later. The paper then gets disposed of at some point with the full credit card info and name written on them.
- dzhiurgis 5y agoIsn't that how booking.com still operates with like millions of hotels worldwide, but via fax machine?