3 ms·
The plain text password thing might have been an edict come down from marketing. For example, they might find that people who forget their password become less
by jiggy2011 14y ago
The plain text password thing might have been an edict come down from marketing.
For example, they might find that people who forget their password become less likely to use the site because when they get their new (hard to remember) password emailed to them they can't figure out how to change the password back to what it used to be. This means they end up resetting their password every week to do their shopping.
- metachris 14y agoBut... a proper password reset mechanism wouldn't send the password via email in first place, but rather a one-time link to set a new one.
- jiggy2011 14y agoTrue, but perhaps they find 0.5% of users get confused by that screen and that 0.5% represents several million £ in revenue.
- Sottilde 14y agoAnd imagine how much being hacked affects revenue! I don't doubt, though, that some sort of similar short-sighted thinking led to this decision. Is it really possible that such a large organization simply doesn't understand password policy? Not to mention, an organization that's on the board of PCI-DSS?
- jiggy2011 14y agoPossibly not that much, as long as their security is good enough that they don't get sued. At the point where you are worrying about hashed passwords, your system has already been owned. It also depends on public reaction to the incident, people won't necessarily blame tesco either and blame the "1337 chinese super h4x0rs"
- bmj 14y agoAs someone who was once an inexperienced web dev, I bet this probably didn't come down from marketing, and instead is the result of inexperienced/uneducated developers.