Slashdot Mirror
Ask Slashdot: Dealing With Companies With Poor SSL Practices?
An anonymous reader writes Despite recent highly-publicized hacking incidents making the news, companies continue to practice poor cyber-security. I signed-up to buy something from [an online vendor] and upon completing signup through HTTPS, was sent my username and password in plain-text through e-mail. This company has done everything in its power to avoid being contacted for its poor technical practices, including using GoDaddy's Domains By Proxy to avoid having even WHOIS information for their webmaster's technical contact from being found. Given such egregious behavior, what do you do when you're left vulnerable by companies flagrantly violating good security practice?
Use an online review tool. Like say google. Then put your grievance there. They do not want to know, well just put your sticker up then move on and do not deal with them anymore. It is not your problem to fix.
Yes there are *many* things on the internet that are broken. Yes you will find people who go 'oppps my bad' and fix it. You will also find many who *do not care*. They never will. You cant fix stupid.
EOM
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
There really isn't much you can do about companies like this, except shop elsewhere. Sooner or later, they will have a breach, and the "security researchers" will have your credit card data.
If you want news from today, you have to come back tomorrow.
Please don't hide whom it is that I might accidentally do business with. Nothing is going to change just sending them an email, they may even go after you for doing so. However you may stop others from being suckered when their poor security becomes everyone else's problem. It's not their problem, it's going to be everyone else's.
First assumption is that there isn't somewhere that'll get broken. Everywhere probably will get successfully attacked at some point. Use a password manager. At least this way, when somewhere is broken, I'm sure that it's the only place where that password is used.
I think I just cashed out all my cool points.
has nothing to do with "poor SSL practices".
Your issue is apparently with them sending your password by email. This has nothing to do with SSL. Having a password stored in an inbox is bad for security reasons that have for the most part little to do with secure transport.
Can you reset it? If so, is it done on an HTTPS form? That's not ideal, but it's not immensely worse than those millions of websites that will send a "reset password link" by email.
I'm not saying their approach is fantastic, but I don't see reasons to get your panties in a bunch. If you are concerned with their email approach (which is not the same as "poor SSL practices") reply to that email (redacting your password), and if you're not happy with their answer or lack thereof, don't buy from them anymore. You don't need to Ask Slashdot for that.
lucm, indeed.
Pretty simple: don't shop there.
You ignored multiple red flags, yet you are surprised when they email you your password? (Which, of course, as others have pointed-out, has nothing to do with SSL.)
Any one of these looses any company my business:
- Expired, non-matching, self-signed, localhost, example.com, etc. etc. SSL certificate
- Domain proxy registration (companies should not have "privacy")
- Hide contact information
- mailed me my password
- doesn't offer payment choices, only one payment type
If their security is so bad, you should be able to hack into their network.
Once you've done so, post the story of the hacking on the internet.
Nothing like public embarassment to make them clean up their security practices.
Deal with reality - the world as it is - rather than ideality - the world as you would like it to be.
1. Name and shame them. Don't pussyfoot around. Worst-case scenario, you'll get their contact info when they act all butt-hurt and make empty threats to sue (for what, exactly? Negative online reviews are protected speech). Not just on "review sites", which often are "we will remove the negative review if you buy our services" scams (cf: Yelp), but sites that YOU use. People only go to these sites after the fact. They're worthless.
2. Change your password and see if they send you back the updated info in plaintext. If they do, it's not just ONE bug.
3. Shop elsewhere. Use sites recommended by people you know who have actually used them and had good experiences, not some $RANDOM_SITE_WITH_LOWEST_PRICE that may be some kid in a basement and his mom who don't have a clue. If they're the lowest price, it may be because they're skimping on things like security and not because they have bulk buying power.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
And the author of that one *also* does not name the offending company.
Raising the issue in a vacuum is fruitless, because there's no general panacea for corporate security stupidity. Other users won't know until they receive their passwords in the mail that they've opened an account with a company that should be marked "Fail".
So mark them. Here's a good place to start, and the above blogger should have done it also. Otherwise you're just blowing off steam.
FWIW, I've read (too lazy to look up citation) that closing one CC account and opening another can hurt your credit score. Ask your issuer to assign your account a new number.
I refuse to believe corporations are people until Texas executes one. -- desert rain on http://www.dailykos.com/user/
There really isn't much else you can do, publicise the bad companies so that those who do care can avoid them. Only if they start losing business will any company even consider doing anything about it.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
It drives me bananas when people write posts like this and I see it online alll the time. Unless you care more about some corporation than your fellow consumer, NAME NAMES! There is essentially ZERO reason for a company to change practices other than bad PR, and you can't create that without naming them.