Slashdot Mirror
CNBC Just Collected Your Password and Shared It With Marketers (pcworld.com)
SpacemanukBEJY.53u writes: An article published by CNBC on Tuesday offered tips on how to create a secure password, complete with a form that tested submitted passwords. While well-intended, security experts said it exposed passwords to third-party advertisers. Also, the form created to test a password didn't use SSL/TLS, which meant someone on the same network could have sniffed it. Even worse, the tool claimed to not store the passwords, but an acute observer found they were actually being inputted into a Google Docs spreadsheet. CNBC quickly withdrew the article.
Has your credit card number been stolen? Enter it here to find out!
1234iamsosmart
They were obviously applying Torvalds' Secret Sauce.
They even pushed it one step further: Willing is for willers. Does just Do.
I saw something years ago that was an online password strength checker. There was just no way I was going to use it because my immediate thought was that exactly this could happen.
People that persist with weak passwords are a lost cause but there are people who take the security a bit more seriously and are vaguely aware of password strength even if they don't know what password entropy is and they *want* to know if they've made a good password, making them easy fodder for traps like this.
I guess I should add "don't ever use a password strength checker" on those occasions when family ask computer security advice.
Perhaps you are a little young, I used several non MS OS'es and desktops before MS managed to put a stranglehold on development
If it hadn't been Microsoft then it would have been some other company that became dominant supplying operating systems to desktops. The move to smaller and more mobile computing would have happened regardless as the technology enabled it. Maybe a bit differently but still inevitably. And whatever company did gain the dominance on the desktop would have been unpopular too.
I want to go enter 12345, hunter2, and the standard test machine password at both HP and Microsoft: abc123.
do not know where to begin. omfg. cnbc should stick to infomercials and 3rd rate olympics events every 2 years.
Perhaps you are a little young, I used several non MS OS'es and desktops before MS managed to put a stranglehold on development
Maybe you forgot that the company was founded in 1975, and their forté in the early years was development tools (compilers and interpreters).
When reminded of that, people tend to go like 'ah yeah, MSX Basic'. No -- MSX was one of the later products, half way into the 1980's. I'm talking Fortran-80, Basic-80, Cobol-80.
With 80 not signifying a year or decade, but a microprocessor family.
It's good that Slashdot uses an automatic password filter that converts posted passwords into stars.
For example, my password is ******** but it doesn't show up in the post. Yeah, I know eight characters really isn't long enough but the first character is an uppercase letter and has a number at the end.
Why don't you all give it a try.
What utter bollox. Computers were coming to everyone because the got vastly cheaper than central systems, and most people do not need jumped up pillocks like sys-admins acting as gatekeepers for everything.
There was no PC revolution. 8 bit micros were already in peoples' homes under various manufacturers and operating systems. The early machine on a office desk didn't even run DOS, twat.
CNBC is pants.
If you post as an AC, don't expect me to spend a mod point on you.
Nope. First used MS-BASIC in a 16KB TRS-80 (Model 1??) in 1979.
"I don't know, therefore Aliens" Wafflebox1
I always thought 80 stood for 80 columns.
That gives me an idea. In the modern world sys admins could sell their services like gardeners or pool guys do. One could have one's own sys admin butler person.
CNBC would never attract real business people or investors. It's a lame mostly liberal business site that mostly caters to the consumer investor who is happy with mostly amateur investor advice. It's not surprising they would do something lame and a security problem. This remember is a site who worships Jim Cramer as some investment guru.
Can we please stop with the clickbait headlines? News that's more than one hour old did not "just" happen. Unless you're live-blogging on Twitter, whatever you're posting about is going to sound instantly dated. Moreover, it "just" sounds unprofessional — in terms of journalistic "voice," your news now lacks authority and sounds as if it's being delivered by a teenager.
I worked in journalism for 12 years, full-time and freelance. The dumbing-down of journalism and the rise of clickbait-style reporting are driving away readers, not attracting them. That's especially true for sites like /. where people do actually, sometimes, expect informative and accurate stories ...
Just to days short and CNBC would have make fool of itself on April Fool's day! ;)
After researcher on Valve, season is starting early this year.
Lucky! We only had the 4K models.
And the 16K TRS-80 Model III debuted at $4,299 in THOSE years' dollars!
CNBC Just Collected Your Password and Shared It With Marketers
No it didn't. Please try writing a real headline.
systemd is Roko's Basilisk.
So the test password I entered:
$#%DFGSDFGHZafb39dg2##$!
is out there for everyone to use? *tears up sticky note attached to monitor with the password written on it*
(This joke inspired by a co-worker who used to have an index card with a 5x5 grid of UserIDs and passwords for 25 different internal/external sites he had to access regularly taped to his monitor....)
I've always like the kidney harvesting joke myself
The asses of the many outweigh the asses of the few, or the one.
> Even worse, the tool claimed to not store the passwords, but an acute observer found they were actually being inputted into a Google Docs spreadsheet.
I dunno, I thought he was kind of ugly.
Ohhhh, you mean *obtuse*? Sorry.
You see those "games" that leave you with "your dragon ninja name" or other such bullshit, after first collecting the first three digits of your ATM PIN then the name of your first pet then the last digit of your PIN? That's what I'm talking about.
The number of people that scam catches and they don't even realise it, makes me weep.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
nope. Intel 8080, which was the next step up from the 8008 and the predecessor to the 8085.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
Would they speak English?
What people should learn from this is that while the media loves to think that they know everything about everything, they really don't know jack squat. Sadly, far too many people believe the media particularly when they cherry-pick elements of a story or pull the NPR tactic of reporting one specific incident hoping that the listener will generalize in that direction.
Might Ad-blocking have stopped this? The industry wants to ban ad-blocking, but every other day there is a story about malicious 3rd party exploits using ads as a vector. Why does a news site have to have some horrible complicated Javascript Ad intwined code to function? Note to industry, the ad can be sandboxed as a static entity separate from the main page Javascript. Likely this time the passwords didn’t end up in the hands of hostiles, but who knows, especially since now they know to go look to see if it was collected as part of other behind the scenes shenanigans. The idea that the page should be “Collecting” page event information from the page for 3rd parties is pretty scary.
Letter To Iran
Hit the jump for meandering anecdotal bullshit that never actually explains anything
I have Verizon FiOS service, and they provide a WiFi router that connects the home to the FiOS service. The router not only stores your router / WiFi password in plain-text, but it sends it back to Verizon where it's stored unencrypted. They not only don't tell you, but the entire thing is insecure by design.
I even complained, and their tech support denied it initially, and when I pointed out how I figured it out (namely that your password is displayed on the account page on their website, and you can alter the router password from that page), they changed their tune. It's not a security flaw, it's a feature, your service is secure -- even if your password is compromised.
That's cute. I don't see how anyone could prosecute a copyright case or even a child-porn investigation against a FiOS customer knowing that customer's router passwords are effectively public (at least, easily obtained by a knowledgable person).
And besides that I've never visited CNBC and never checked my password on some web form, so the headline is false in my case.
"... an acute observer found they were actually being inputted into a Google Docs spreadsheet."
Now that's the absolute height of security, nothing could possibly be more secure than that.
Just cruising through this digital world at 33 1/3 rpm...
>Even worse, the tool claimed to not store the passwords, but an acute observer found they were actually being inputted into a Google Docs spreadsheet.
Disgusting. Yet the only surprise is that they chose a google doc for dumping.
"No, nooooo, you're being paranoid, it's not like everything that can scoop data does scoop data."
Herp.
you were a latecomer, we had msft basic on my IMSAI 8080, had to load it via paper tape!
To be fair, the new article I hope they write about this scenario will only need to be two sentences long: DO NOT GIVE YOUR PASSWORDS TO ANYONE. DO NOT USE THE SAME PASSWORD FOR MULTIPLE SITES.
But if they wanted to make it more informative / memorable, they could describe how they may be able to impersonate someone if they can associate one of the entered passwords with one of their registered users (via IP address; not perfect but perhaps good enough) and if that the user used that same password on other sites, like Amazon, Facebook, Twitter, eBay, etc.
By sharing data with a "news" service you get what you deserve! Isn't that what they do, is share?
(And here I am online on the double-entendre of wholly-owned subsidiary of a media company.)
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT