4 ms·

Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at http://www.realestate.com.au/ http://www.realestate.com.au/ Just

Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at http://www.realestate.com.au/ http://www.realestate.com.au/ Just to refresh your memory.. https://twitter.com/#!/realestate_au/status/22073191480430592 https://twitter.com/#!/realestate_au/status/2207319148043059... Anyway, "we are aware of this issue and are working on it". Click http://www.realestate.com.au/ http://www.realestate.com.au/ then "Register". Then stand in utter amazement at their solution. ------------------------------------------- Why do we need your email address? *We send your password via email.* *Your email address is your log on.* *If you forget your password, we'll send you a new one.* ------------------------------------------- This is hilarious. I can only assume that they took offence to you choosing a "strong version" password, so they decided, how can we fix this? I know, lets just pick the password for them. So, their fix that they told you about, was to ensure that you can't pick a password at all, and they will still email you their "super strong version password"... > Thank you for registering. Your password has been sent to username[at]gmail.com. It should arrive shortly. 12 seconds later. Your password is: DTCNE (In case people aren't aware, realestate.com.au is owned by HomeAway)

lengarvey 14y ago
In slight defense of that horrible password practice: You can't really do much with a realestate.com.au account unless you are an Agent (which is a separate account). There's no payment processing, or any way to add content to the site. The accounts there are basically just a way to save common realestate searches as far as I can tell.
- jrsimmons 14y ago
  Yeah, no. All private user information is equally private. To arbitrarily suggest that certain data is less important is a dangerous road to walk down. We should be holding everyone to the same standards when it comes to security. This is especially true with the high amount of password reuse that goes on.
  - tomgallard 14y ago
    I'm not sure I agree. I'd say my name is private, I'd say my date of birth is more private, I'd say my medical conditions are more private still. There are clearly degrees of privacy. Does it really make sense to hold my bank to the same standard as a real estate website? Sure they should all reach some minimum requirement (salted and hashed passwords), but I expect my bank to have far higher standards (e.g. two factor auth) than a a random site.
    - pmjordan 14y ago
      The problem with storing passwords insecurely is that people reuse them. You can try to tell them otherwise as much as you like, they will do it, so even if one service holds non-sensitive data, stealing the password will grant access to other, completely unrelated services.
    - jrsimmons 14y ago
      Yeah that was overly simplistic. I guess the issue is that the layman cannot really tell how secure a solution is, and so are unlikely to be able to make well reasoned decisions about the information they release. As such there really needs to be a far greater level of responsibility placed on people who hold the keys so to speak. Once again this is especially true since people re-use (and use overly simple) passwords at a scary rate. By not protecting their information on a crappy real estate website you are potentially leaving open their bank to abuse. I feel instances like these just show dangerous levels of incompetence and a blatant disregard for user's information. Good solutions generally require less work anyway so there's no excuse.
  - sp332 14y ago
    This is clearly not true, or HIPPA would apply to my street address, and sites that want my phone number would have to be PCI compliant.
    - danudey 14y ago
      PCI compliance is an industry standard, not a regulatory standard, so it's not a valid comparison. Also, PCI compliance isn't for privacy reasons, it's for loss mitigation. Amusingly enough, the banks who impose PCI compliance on merchants aren't themselves required to be PCI compliant, and some of them will happily e-mail you extremely sensitive customer data (no matter how many times you ask them not to), even though doing so yourself would violate PCI compliance.
- troyhunt 14y ago
  Actually, you do a lot with them; I could take a significant portion of them and log on to the account holders' Twitter / Facebook / GMail. Reuse is rampant and anyone who holds credentials has a duty of care to protect them.
legutierr 14y ago
Do you know who else does this? The US Department of Labor when you register/reset/change your password with the PERM system.
- freditup 14y ago
  I don't mind the emailing of a new password for password reset requests. It seems just as secure as the password change link that most sites use. It does have the potential to be more annoying to the user if other people are submitting fake password reset requests though, which is why I'd still go with the password change link.
Wilya 14y ago
Well, let's look at the good side of it. At least it limits the risks of password reuse.
- tripzilch 14y ago
  You don't know that for sure. For all we know, they email "DTCNE" to everybody.
albahk 14y ago
As far as I know, realestate.com.au is not owned by Homeaway.com - its listed on the ASX under REA Group http://en.wikipedia.org/wiki/REA_Group http://en.wikipedia.org/wiki/REA_Group
- kyrra 14y ago
  Agreed, HomeAway does NOT own realestate.com.au (so says my friends at homeaway when I forwarded them this comment).
daigoba66 14y ago
They POST forms unencrypted. And either they don't have an HTTPS version of the site, or it's broken.
tibbon 14y ago
Several pages that do this: (Search for "We send your password via email") https://www.google.com/webhp?sourceid=chrome-instant&ie=UTF-8&ion=1#hl=en&output=search&sclient=psy-ab&q=%22We%20send%20your%20password%20via%20email%22&oq=&gs_l=&pbx=1&fp=ae58233f8dcb0b2c&ion=1&bav=on.2,or.r_gc.r_pw.r_cp.r_qf.,cf.osb&biw=1017&bih=913 https://www.google.com/webhp?sourceid=chrome-instant&ie=...
duncan_bayne 14y ago
I've given someone I know at REA a heads-up; hopefully he'll have the clout to fix it. In other news it's not just REA. I checked and my ISP (TPG) does the same :-(

lengarvey 14y ago

In slight defense of that horrible password practice: You can't really do much with a realestate.com.au account unless you are an Agent (which is a separate account). There's no payment processing, or any way to add content to the site. The accounts there are basically just a way to save common realestate searches as far as I can tell.

jrsimmons 14y ago
Yeah, no. All private user information is equally private. To arbitrarily suggest that certain data is less important is a dangerous road to walk down. We should be holding everyone to the same standards when it comes to security. This is especially true with the high amount of password reuse that goes on.
- tomgallard 14y ago
  I'm not sure I agree. I'd say my name is private, I'd say my date of birth is more private, I'd say my medical conditions are more private still. There are clearly degrees of privacy. Does it really make sense to hold my bank to the same standard as a real estate website? Sure they should all reach some minimum requirement (salted and hashed passwords), but I expect my bank to have far higher standards (e.g. two factor auth) than a a random site.
  - pmjordan 14y ago
    The problem with storing passwords insecurely is that people reuse them. You can try to tell them otherwise as much as you like, they will do it, so even if one service holds non-sensitive data, stealing the password will grant access to other, completely unrelated services.
  - jrsimmons 14y ago
    Yeah that was overly simplistic. I guess the issue is that the layman cannot really tell how secure a solution is, and so are unlikely to be able to make well reasoned decisions about the information they release. As such there really needs to be a far greater level of responsibility placed on people who hold the keys so to speak. Once again this is especially true since people re-use (and use overly simple) passwords at a scary rate. By not protecting their information on a crappy real estate website you are potentially leaving open their bank to abuse. I feel instances like these just show dangerous levels of incompetence and a blatant disregard for user's information. Good solutions generally require less work anyway so there's no excuse.
- sp332 14y ago
  This is clearly not true, or HIPPA would apply to my street address, and sites that want my phone number would have to be PCI compliant.
  - danudey 14y ago
    PCI compliance is an industry standard, not a regulatory standard, so it's not a valid comparison. Also, PCI compliance isn't for privacy reasons, it's for loss mitigation. Amusingly enough, the banks who impose PCI compliance on merchants aren't themselves required to be PCI compliant, and some of them will happily e-mail you extremely sensitive customer data (no matter how many times you ask them not to), even though doing so yourself would violate PCI compliance.
troyhunt 14y ago
Actually, you do a lot with them; I could take a significant portion of them and log on to the account holders' Twitter / Facebook / GMail. Reuse is rampant and anyone who holds credentials has a duty of care to protect them.

legutierr 14y ago

Do you know who else does this? The US Department of Labor when you register/reset/change your password with the PERM system.

freditup 14y ago
I don't mind the emailing of a new password for password reset requests. It seems just as secure as the password change link that most sites use. It does have the potential to be more annoying to the user if other people are submitting fake password reset requests though, which is why I'd still go with the password change link.

Wilya 14y ago

Well, let's look at the good side of it. At least it limits the risks of password reuse.

tripzilch 14y ago
You don't know that for sure. For all we know, they email "DTCNE" to everybody.

albahk 14y ago

As far as I know, realestate.com.au is not owned by Homeaway.com - its listed on the ASX under REA Group http://en.wikipedia.org/wiki/REA_Group http://en.wikipedia.org/wiki/REA_Group

kyrra 14y ago
Agreed, HomeAway does NOT own realestate.com.au (so says my friends at homeaway when I forwarded them this comment).

daigoba66 14y ago

They POST forms unencrypted. And either they don't have an HTTPS version of the site, or it's broken.

tibbon 14y ago

Several pages that do this: (Search for "We send your password via email") https://www.google.com/webhp?sourceid=chrome-instant&ie=UTF-8&ion=1#hl=en&output=search&sclient=psy-ab&q=%22We%20send%20your%20password%20via%20email%22&oq=&gs_l=&pbx=1&fp=ae58233f8dcb0b2c&ion=1&bav=on.2,or.r_gc.r_pw.r_cp.r_qf.,cf.osb&biw=1017&bih=913 https://www.google.com/webhp?sourceid=chrome-instant&ie=...

duncan_bayne 14y ago

I've given someone I know at REA a heads-up; hopefully he'll have the clout to fix it. In other news it's not just REA. I checked and my ISP (TPG) does the same :-(