5 ms·
If only Google Chrome would start warning users on signup that their password would be stored in plain text.
by mtrimpe 14y ago
If only Google Chrome would start warning users on signup that their password would be stored in plain text.
- Smerity 14y agoGoogle Chrome and the Google search engine warn you if a website contains malware or is suspected of phishing. Poor security is just as dangerous as these, the only thing missing is the malicious intent. Unfortunately, Google would likely open themselves to lawsuits if they warned users away from or penalised websites due to poor security.
- ZoFreX 14y agoIt's a sad reflection of the state of things that we worry Google would be subject to lawsuits for trying to guide users away from almost-certain disaster, yet no one is naive enough to believe that a lawsuit could result from storing my password for an online shopping site in plaintext.
- tripzilch 14y ago> that we worry Google would be subject to lawsuits for trying to guide users um no, it's Google that would worry. Myself, I don't care if they got a lawsuit. I'd applaud G for trying (and who knows the publicity that such a lawsuit would (hopefully) generate might do some additional good). I can imagine Google not pursuing such a strategy without a really good reason, though.
- omh 14y agoPoor security is just as dangerous as these, the only thing missing is the malicious intent. Really? This password storage isn't great, but using tesco.com is hardly the same as visiting a malware or phishing site. Unless/until Tesco have their databases hacked or stolen there is no risk at all.
- Smerity 14y agoPoor security references far more than just poor password storage, but even poor password security by itself becomes a serious issue incredibly quickly. Most people re-use passwords and most passwords are reset by email, meaning a leaked password and email address combo can quickly lead to massive damage. Not all security exploits require a database to be hacked either. Even if a database is hacked, half the time we're finding out about this from third party sources well after the fact instead of the companies released press releases themselves. These things happening silently is horrific[1]. Malware or phishing sites are relatively easy to spot and defend against -- but what about a compromised but legitimate website? If I find a security hole and pick a small but high quality selection of targets, how long will it take authorities (if ever) to piece together that they all were members of CornerStore Online? [1]: We still have no idea when Twitter lost their 6.5 million password hashes -- they probably don't either... http://news.ycombinator.com/item?id=4074510 http://news.ycombinator.com/item?id=4074510
- damncabbage 14y agoWe still have no idea when Twitter lost their 6.5 million password hashes Twitter or LinkedIn?
- Smerity 14y agoOops - I meant LinkedIn! I have no clue how that slipped into Twitter. Unfortunately I can no longer edit, hopefully the link itself is self explanatory.
- alsothings 14y agoUnless/until Tesco have their databases hacked or stolen there is no risk at all. This is not the case. The most glaring reason why was pointed out in the posted article. It very clearly showed that Tesco failed to communicate logged-in state information (stored in a cookie) between the client and server over an encrypted line. This means your account is vulnerable to attack without the entire db being leaked.
- gizmo686 14y ago