4 ms·
This is a hilarious, albeit depressing, view of the state of cyber security as seen by the general public. People, even those who are generally considered compu
by Smerity 14y ago
This is a hilarious, albeit depressing, view of the state of cyber security as seen by the general public. People, even those who are generally considered computer literate, don't have any understanding of web security. Due to this, Tesco won't hit any negative publicity outside of a tight knit circle of programmers. In fact, saying that everything is "stored securely" according to "industry standards" would reassure most people.
There have been many calls in past exploit threads for a name and shame policy, but that won't do anything. Name and shame only works when people keep up with the list, and people won't. They're too busy with their lives to focus on a list, especially given the number of insecure websites around the world.
We need everyone to have a list of easy to remember rules about web security from a consumer perspective. This list of rules needs to reach everyone. Putting them in the browsers may lead to the exposure needed, but I don't see that happening.
This primitive level of education needs to start breaking through as it's only going to get worse as computing and security advance further. We haven't even finished explaining to people that plain text passwords almost always indicate impending disaster, yet we already need a way to explain MD5 is never enough and SHA256 isn't enough without a salt...
- mtrimpe 14y agoIf only Google Chrome would start warning users on signup that their password would be stored in plain text.
- Smerity 14y agoGoogle Chrome and the Google search engine warn you if a website contains malware or is suspected of phishing. Poor security is just as dangerous as these, the only thing missing is the malicious intent. Unfortunately, Google would likely open themselves to lawsuits if they warned users away from or penalised websites due to poor security.
- ZoFreX 14y agoIt's a sad reflection of the state of things that we worry Google would be subject to lawsuits for trying to guide users away from almost-certain disaster, yet no one is naive enough to believe that a lawsuit could result from storing my password for an online shopping site in plaintext.
- tripzilch 14y ago> that we worry Google would be subject to lawsuits for trying to guide users um no, it's Google that would worry. Myself, I don't care if they got a lawsuit. I'd applaud G for trying (and who knows the publicity that such a lawsuit would (hopefully) generate might do some additional good). I can imagine Google not pursuing such a strategy without a really good reason, though.
- omh 14y agoPoor security is just as dangerous as these, the only thing missing is the malicious intent. Really? This password storage isn't great, but using tesco.com is hardly the same as visiting a malware or phishing site. Unless/until Tesco have their databases hacked or stolen there is no risk at all.
- Smerity 14y agoPoor security references far more than just poor password storage, but even poor password security by itself becomes a serious issue incredibly quickly. Most people re-use passwords and most passwords are reset by email, meaning a leaked password and email address combo can quickly lead to massive damage. Not all security exploits require a database to be hacked either. Even if a database is hacked, half the time we're finding out about this from third party sources well after the fact instead of the companies released press releases themselves. These things happening silently is horrific[1]. Malware or phishing sites are relatively easy to spot and defend against -- but what about a compromised but legitimate website? If I find a security hole and pick a small but high quality selection of targets, how long will it take authorities (if ever) to piece together that they all were members of CornerStore Online? [1]: We still have no idea when Twitter lost their 6.5 million password hashes -- they probably don't either... http://news.ycombinator.com/item?id=4074510 http://news.ycombinator.com/item?id=4074510
- damncabbage 14y agoWe still have no idea when Twitter lost their 6.5 million password hashes Twitter or LinkedIn?
- Smerity 14y agoOops - I meant LinkedIn! I have no clue how that slipped into Twitter. Unfortunately I can no longer edit, hopefully the link itself is self explanatory.
- alsothings 14y agoUnless/until Tesco have their databases hacked or stolen there is no risk at all. This is not the case. The most glaring reason why was pointed out in the posted article. It very clearly showed that Tesco failed to communicate logged-in state information (stored in a cookie) between the client and server over an encrypted line. This means your account is vulnerable to attack without the entire db being leaked.
- muyuu 14y agoMore than depressing I consider this to be a reality check. Procedures must be put in place for people who can't be expected to deal with this kind of thing properly.
- SideburnsOfDoom 14y ago> There have been many calls in past exploit threads for a name and shame policy There is an attempt at naming and shaming here: http://plaintextoffenders.com/ http://plaintextoffenders.com/
- bct 14y agoI'm bothered that that blog doesn't distinguish between sites that (A) email generated passwords for new accounts and sites that (B) email plaintext passwords for existing accounts.
- path411 14y agoAfter looking at that site I find it hard to tell if they are receiving the password they entered in the email or a randomly generated password on account creation. If the password is a generated, typically "temporary" password, there is no real indication of it being stored in plain text then.
- patrickk 14y agoMaybe the solution is for a 'white hat' hacker to hack them, send them an email (oh btw here's the usernames and passwords of thousands of your customers). That might light a fire under their ass. Edit: And publicly blog about it to shame them into action.
- alexmuller 14y agoWhile nice, it would be trivial to send you to prison for doing that: https://en.wikipedia.org/wiki/Computer_Misuse_Act_1990#The_Computer_Misuse_Act https://en.wikipedia.org/wiki/Computer_Misuse_Act_1990#The_C...
- djhworld 14y agoI put it down to training more than anything. I bet Tesco haven't offered any of their development staff a structured (possibly external) training course on web security. While training your staff won't solve all your security problems, I still think it'll help mitigate a lot of them.