4 ms·
That is not just negligence, that is stupidity on an order of magnitude that the responsible people should never again be allowed to work on a software project.
by zilti 3y ago
That is not just negligence, that is stupidity on an order of magnitude that the responsible people should never again be allowed to work on a software project.
- 8organicbits 3y agoEvery company I've worked for, and every pentest contract I've done has found plaintext passwords or credentials stored somewhere they shouldn't. It's unfortunately very common.
- Topfi 3y agoCustomer credentials as in this example? I'll be totally frank, I'm having some trouble reconciling that with Article 34 of the GDPR and 1798.150 of the CCPA. Do none of these organizations have EU/CA customers or is the approach they take to laws the same as the one they employ for database security?
- 8organicbits 3y agoLess common with things that are directly "customer passwords", but common with other credentials and customer data. Those laws require reporting about breaches and I know I get notifications about breached data somewhat often. Keep in mind, a good first step to improving security is to hire a pentester. So pentesters have a unique view into companies that are trying to improve. Often the starting place is quite poor. When I leave those contracts, to my knowledge, they are all on track to fix these sorts of defects.