Slashdot Mirror

← Back to Stories (view on slashdot.org)

Millions of Utility Customers' Passwords Stored In Plain Text (arstechnica.com)

Posted by BeauHD on from the plain-wrong dept.

schwit1 shares a report from Ars Technica: In September of 2018, an anonymous independent security researcher (who we'll call X) noticed that their power company's website was offering to email -- not reset! -- lost account passwords to forgetful users. Startled, X fed the online form the utility account number and the last four phone number digits it was asking for. Sure enough, a few minutes later the account password, in plain text, was sitting in X's inbox. This was frustrating and insecure, and it shouldn't have happened at all in 2018. But this turned out to be a flaw common to websites designed by the Atlanta firm SEDC. After finding SEDC's copyright notices in the footer of the local utility company's website, X began looking for more customer-facing sites designed by SEDC. X found and confirmed SEDC's footer -- and the same offer to email plain-text passwords -- in more than 80 utility company websites. Those companies service 15 million or so clients (estimated from GIS data and in some cases from PR brags on the utility sites themselves). But the real number of affected Americans could easily be several times that large: SEDC itself claims that more than 250 utility companies use its software.

81 comments

  1. Up to *some* good. by Anonymous Coward · · Score: 0

    Yes bad things will happen...like a criminal will pay my electric bill. Thanks, bad guy!

    1. Re:Up to *some* good. by ShanghaiBill · · Score: 2

      Yes bad things will happen...like a criminal will pay my electric bill. Thanks, bad guy!

      Many people use the same password for everything. So if you know the password they use to pay their electric bill, you also know the password to their bank account.

      We need to have some basic security education. People should know that password reuse is bad, but they should also know that a website should not be offering to email them their plaintext password.

    2. Re:Up to *some* good. by Anonymous Coward · · Score: 1

      We need to have some basic security education.

      We've tried that. I have co-workers who brazenly tell me they use the same password for everything. If I need them to logon as themselves for troubleshooting a problem, they will just tell me their password or think I already know what it is. When they do that, I ask them "Really? Where do you bank?" They just give me a blank stare.

    3. Re:Up to *some* good. by Anonymous Coward · · Score: 0

      Interesting one guy I work with in Palo Alto does the same.

      By the way, is anybody aware of the utilities providing services to 1919 Fruitdale San Jose?

    4. Re:Up to *some* good. by Anonymous Coward · · Score: 0

      CD Reimer gave $71 to Second Harvest Food Bank to show VOX Media and The Verge. #SomethingPositive

    5. Re: Up to *some* good. by Anonymous Coward · · Score: 1

      Hartford auto insurance does this and they let you reset your password by answering secret questions on the site without even sending an email. They only send an email after you reset the password to tell you your password was changed.

      The data gathered from breaches can be combined and has been into a database (you can find it online). From the utility company hackers learn the physical address that goes with your email address and your name and phone number.

      From insurance info they learn your physical address, vehicle license plate and VIN number, your phone number.

      That, coupled with your published social media info, can yield enough info to cross-reference you with other breached data and launch a vicious identity theft campaign against you, including logging into other sites, taking out loans in your name (after they easily get your social security number) and taking over your bank accounts by walking into a bank like wells fargo and opening a new account with a fake driverâ(TM)s license and social security card then transfer your money into the new account (this happened to a friendâ(TM)s friend who lost $60k; it took 4 months and 100 hours of her time to get the money back from very uncooperative Wells Fargo, after which she and the common friend dumped 4th-world WF for a highly-rated regional bank).

    6. Re:Up to *some* good. by Anonymous Coward · · Score: 0

      I use the same password for everything.
      Everything unimportant that is.

      I don't think I would be comfortable with using a bank that would allow me to log in with just a password.

  2. Is there a list of affected utility companies? by Anonymous Coward · · Score: 0

    X came up with a list of 89 affected utilities, with an estimated 15+ million customers (using GIS records and, in some cases, meter counts posted on the utility sites themselves). I bumped that list up to 133, after removing duplicate domains. (I did not attempt to replicate X's methodology for estimating total customers on the 44 additional utilities I found.) This is still well short of the 250+ utility clients SEDC themselves claim.

    Ars is not publishing a full list, to avoid making it easier for any would-be malicious attackers to hit every possible target. Concerned Ars readers should check their utility company's site for an offer to send a copy of forgotten passwords by email—and might also want to view the HTML source of the online payments page and look for an "SEDC" copyright.

    1. Re:Is there a list of affected utility companies? by Cmdln+Daco · · Score: 3, Informative

      I would need to have an 'online relationship' with my utility companies for this to become a problem. I practice security-through-postage-stamps.

    2. Re:Is there a list of affected utility companies? by Anonymous Coward · · Score: 0

      funny thing is (well, especially with banks, but I could see utility companies, etc doing this as well) -- many places want to deal with me electronically only, no paper statements, and they claim *that* is more secure ...

    3. Re:Is there a list of affected utility companies? by Anonymous Coward · · Score: 1

      i go one step further. i only pay the bill in person and hand my money directly to the administrative assistant that prepares and mails the invoices and processes all the other mail and in person payments for our small town.

    4. Re: Is there a list of affected utility companies? by Anonymous Coward · · Score: 0

      An example of why America needs more regulation. This doesn't happen in other western nations.

    5. Re:Is there a list of affected utility companies? by reboot246 · · Score: 1

      I do pay my utility bills online, but not through each utility's individual website. They all want people to do that, but I don't need more usernames and passwords to keep up with. I pay through my bank's website.

      The only utility that knows my email address is the cable company that is also my isp, and that email address is the one they provide and I don't use.

      If you shop online, use a re-loadable debit card - balance up, balance zero. Most banks will provide one, check and see if yours does.

    6. Re: Is there a list of affected utility companies? by YrWrstNtmr · · Score: 3, Informative

      An example of why America needs more regulation. This doesn't happen in other western nations.

      Sweden - https://www.bbc.com/news/techn...
      Germany - https://www.theguardian.com/wo...
      France - https://techcrunch.com/2018/12...
      Spain - https://www.theinquirer.net/in...

    7. Re:Is there a list of affected utility companies? by cascadingstylesheet · · Score: 1

      I would need to have an 'online relationship' with my utility companies for this to become a problem. I practice security-through-postage-stamps.

      I suppose if the postal carriers in Chicago only throw your mail in the dumpster, that might work.

      Of course, someone else might get it out of the dumpster ...

    8. Re:Is there a list of affected utility companies? by Anonymous Coward · · Score: 0

      And all branches of the US government thanks your for trusting them with all of your personal information.

  3. Different by Anonymous Coward · · Score: 0

    I use a different password for every account I have. I've never regretted it.

  4. Volusion seems to do this as well. by Anonymous Coward · · Score: 1

    I had a couple of stores hosted on Volusion's hosting service, and a couple of years ago their password recovery system sent me my current password, rather than giving me a link to change my password. So clearly they store (or at least used to store) their user passwords in clear text or some recoverable form.

    I tried to explain the clear security issue with this to one of their support techs, but he assured me that they felt this policy was most helpful to their users. Yeah, until everyone's password gets hacked. Good luck there.

    For this and a few other reasons (rising costs, mainly), I've migrated my stores away from them.

  5. I think my bank stores passwords in plain text by whoever57 · · Score: 3, Interesting

    The login doesn't ask for the complete password. Instead, it asks for 4 selected characters from the password plus 3 selected characters from my PIN.

    I don't see how they can validate a few characters from a password unless they have it stored in plain text.

    Actually, this applies to two banks. Both UK based.

    --
    The real "Libtards" are the Libertarians!
    1. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      If they generate and save salted hashes for a bunch of combinations, it could be done without storing the password in a recoverable manner. You'd have to change your password and pin together unless the pin is stored recoverably.

    2. Re:I think my bank stores passwords in plain text by ssyladin · · Score: 1

      Time to get a new bank.

    3. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      Assuming an 8 character password and a 4 character pin, it would take about 640K per customer to store the md5 hash of all possible combinations. So a million customers would require less than 1 TB. Given the current price of storage, that's quite doable.

      Of course, odds are you are correct.

    4. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 4, Interesting

      JP Morgan Chase, until about 26 months ago, only stored the first 8 characters of your password. Let that sink in for a second. A company that is creating a cryptocoin for internal transaction processing was only storing 8 characters of your online banking password.

      Unfortunately these schmucks are still in business.

    5. Re: I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      The better question is why in God's name would you go out of your way to increase complexity of the authentication process while adding no useful additional security? What is the point in doing this?

    6. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      What if your password *is* a SQL injection attack?

    7. Re: I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      it's very likely they are still using some 30 year old mainframe bullshit on the back end. No one voluntarily makes a software decision like that. Guarentee there is some legacy compatibility going on there.

    8. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      There's a major bank in Australia whose passwords are not case sensitive.

    9. Re:I think my bank stores passwords in plain text by _merlin · · Score: 1

      Doesn't AmEx also convert passwords to lowercase before hashing? They don't store the plaintext password - they lowercase it before hashing/verifying.

    10. Re:I think my bank stores passwords in plain text by chrisvdb · · Score: 0

      Or it stores the hashes of all combinations (or the subset it'll ever ask)? Only 8*7*6*5/4! = 70 combinations for an 8 char password... there might be other more efficient algos, though.

      Mine does the same (HSBC).

    11. Re:I think my bank stores passwords in plain text by Time_Ngler · · Score: 3, Informative

      If they are hashing a bunch of combinations of just a few characters of the password, these characters could be easily brute forced, salted or not! After knowing these combinations, brute forcing the rest of the password would be as easy as hell

    12. Re:I think my bank stores passwords in plain text by Time_Ngler · · Score: 1

      Do you realize how insecure that is? Take any four characters, hash them, and check them against the 640K database of hashes per customer. If they are all in the password, you'll get a least one hit.

      It reduces the task of cracking the password to a fucked up form of bingo

    13. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      They still need the LAN Manager compatibility on the back-end.

    14. Re: I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      > No one voluntarily makes a software decision like that.

      No one who has worked in software for a living would make that kind of an assumption.

    15. Re:I think my bank stores passwords in plain text by munch117 · · Score: 2

      I think my bank stores passwords unhashed.

      FTFY. They might store them unencrypted, or they might have an elaborate keyserver setup with a reasonable level of security, you can't know that. Hashing would have been better, but that doesn't mean everything else is garbage.

    16. Re:I think my bank stores passwords in plain text by chrisvdb · · Score: 1

      Or it stores the hashes of all combinations (or the subset it'll ever ask)? Only 8*7*6*5/4! = 70 combinations for an 8 char password... there might be other more efficient algos, though.

      But it's worth noting that doing this is also very insecure...

    17. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      If they generate and save salted hashes for a bunch of combinations, it could be done without storing the password in a recoverable manner. You'd have to change your password and pin together unless the pin is stored recoverably.

      No, they can just store and compare the hashes for the password and the hashes for the pins separately.
      That would allow you to change them independently of each other.

      Still a pretty weird scheme and I'm not particularly convinced that it is secure.
      I guess there is a benefit to it in that someone seeing you enter the password won't be able to use the data unless they luck out on the request.

    18. Re:I think my bank stores passwords in plain text by Bert64 · · Score: 1

      The problem is that you don't know, so you can't make an informed decision as to which companies you do or don't want to do business with.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    19. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      Or it stores the hashes of all combinations (or the subset it'll ever ask)? Only 8*7*6*5/4! = 70 combinations for an 8 char password... there might be other more efficient algos, though.

      But it's worth noting that doing this is also very insecure...

      Yep. Doing this will result in someone cracking the password in less than a millisecond ... on a raspberry pi.

    20. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      My bank does for sure (Royal Bank of Scotland, England). Once I walked into a branch office and when I reached the counter I noticed that I didn't have my card on me. The helpful guy at the other side of the counter said that that was no problem as long as I could give some information, like my date-of-birth, postal code, and my password. I was quite surprised at that, and in fact I wasn't quite sure anymore what my internet password was for their website, I had been living abroad for years and used different banks. He then helpfully gave me a hint so I could guess the password!

      I should point out that for online banking I also need a pin code and some answers to questions (like favorite book etc...). Online, only a few characters of the password are asked at a time, so they must be storing the password in clear text. The only reason I can think of is that they may doing this is perhaps to avoid issues with key loggers, which is perhaps more of a concern than clear text on the server.

      It is possible that they allow for two-factor-authentication, but I never enable this as I travel quite a lot and this could leave me locked out in China and the US.

    21. Re:I think my bank stores passwords in plain text by AmiMoJo · · Score: 1

      With banks the secret phrase they want 3 random characters from is to supplement the full password. In fact it's mostly there to try to defeat key loggers, which is why they make you enter it using drop-down menus on a heavily Javascript laden page that pegs your CPU at 100%.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    22. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 1

      640K ought to be enough for anyone...

    23. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      only in the last year or so did they allow non-alphanumeric "funny characters" like exclamation points in their passwords. It was very annoying.

    24. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      They could store it encrypted with a key allowing them to decrypt it. Not as good as storing one-way digests but still better than plaintext and you'd need the secret key or access to their KMS to decrypt the key.

      However they're still sending it in the email. That's the weak link as it'll be sitting on the mailserver in plaintext and potentially crossing networks in SMTP in plaintext as well.

    25. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      J.p. morgan Chase does not employ one single developer. The entire IT operation there is Indian contractors.

    26. Re:I think my bank stores passwords in plain text by Anonymous Coward · · Score: 0

      What if your password *is* a SQL injection attack?

      Robert'); DROP TABLE comments;-- ?

  6. Re: Not Surprised by Anonymous Coward · · Score: 0

    What is surprising is that this isn't a vice or buzzfeed "article." Because slashdead has stooped to THAT.

  7. So? by Anonymous Coward · · Score: 2, Informative

    How do you know your passwords are stored securely on any given website anyway? Most websites won't (and probably shouldn't) tell you how they store passwords/hashes. Even if they do tell you, should you trust them to tell the truth? The only defense is to never assume your password is stored securely and take measures (don't reuse, 2-factor, change often, etc.) accordingly.

  8. Low cost! by mejustme · · Score: 1

    I have a great idea! Let's make sure we purchase software from the lowest cost bid. Those places keep costs low by hiring low-cost developers. Not bothering with tests and QA. They're also likely to be last on the list of companies to upgrade their process, guidelines, etc. High school students could probably write this in just a few weeks. What could possibly go wrong?

    1. Re:Low cost! by Anonymous Coward · · Score: 0

      Doesn't matter you pay top dollar you still get shit. Harvard bronzed shit, but still shit.

      I would rather pay the cheapest and squeeze more hours out of them.

    2. Re:Low cost! by Anonymous Coward · · Score: 0

      Is that you Jeff?

  9. Relevance? by Anonymous Coward · · Score: 0

    I logged into my machine at work this morning using my password. I didn't regret it.

    1. Re: Relevance? by Anonymous Coward · · Score: 0

      I ate too many breadsticks before my giant bowl of pasta at the Olive Garden. I regretti spaghetti.

    2. Re: Relevance? by Anonymous Coward · · Score: 0

      I have diarrhea.

    3. Re: Relevance? by Anonymous Coward · · Score: 0

      have you eaten at Taco Bell recently?

    4. Re: Relevance? by Anonymous Coward · · Score: 0

      You have creimer?

      That's what we call the resident shit stain around here.

  10. Name and Shame by darkain · · Score: 2

    I warned my ISP at the time, Rainier Connect, of this very issue back in 2012.... is 7 years plenty of time to consider it reasonable discloser to talk about it publicly? Damn right it is. NAME AND SHAME this horrible and dated practice!! https://www.rainierconnect.com...

  11. http://plaintextoffenders.com by Anonymous Coward · · Score: 2, Interesting

    http://plaintextoffenders.com

  12. uh by Anonymous Coward · · Score: 0

    an anonymous independent security researcher

    clears throat.

  13. Well, fuck! by Anonymous Coward · · Score: 0

    I hope no one compromises my utility account and pays the bill for me or anything. I'm honestly not sure what else they could do. I am not in an area served by one of these websites, but my functionality my local utility provides on their website is minimal. Pay bill, sign up for payment plan/extension, report outage/downed lines or gas leak, etc. To change or shut off service, you have to call. I suppose they might be able to figure out an email address of mine or something, but in all honesty, what is the real worst-case scenario of my utility account getting hacked?

    1. Re:Well, fuck! by Anonymous Coward · · Score: 1

      They leverage it to get your checking acct number, empty it. They use the statements and other info to apply for credit cards in your name. They assume your identity, maybe a couple of times, and ruin your credit forever. One of them gets arrested, blames you and comes to your house, he has the address from the statement.

    2. Re: Well, fuck! by Anonymous Coward · · Score: 0

      Yes.

      They can get all the info they need off the website to be able to make a phone call and shut off your service right before a long holiday weekend. Good luck talking to someone about getting it turned on before Tuesday. I hear itâs going to be a hot one...

      Oh, and theyâre going to need a new security deposit. Your old one is coming back as a refund and youâll get it in three weeks.

      Disaster? No, unless you have $600 worth of steaks in a freezer. But itâll still be a major pain in the arse for you. That didnât have to happen.

  14. $100 fine per occurrence by Anonymous Coward · · Score: 0

    Tired of this happening again and again and again and again and again and again and again and again and again and again and again and again and again and again and again...

    Time to stick it to companies even if it puts them under.

  15. What's the worst you've seen? by Anonymous Coward · · Score: 0

    Posting AC to protect my employer.
    I was a sysadmin, and my boss said there's a department, Cardiology, it was for patients medical info that the EMR didn't support at that time. They need this web based app, and you to check it out, and see if there's any reason it won't run on a Citrix Server, and if it's OK, then set them up.

    The first thing I noticed was that after the user logged in, as I navigated the web site's various pages and forms, every URL had the user's ID and password in plain text, so what you saw in the address bar was something like this:
    http//CrapilogySoftware.com/DoSomething?=userID:Bob;password:mydog'sname
    Oh, you say, I forgot to put the "s" in https? Oh no, it was plaintext sent over good ol' http.

    I pointed this out to the 60-year old nurse that was showing this stuff to me. She said the long "What.The.Hell".
    And then she said "Say no more. This is not going to happen".

    1. Re:What's the worst you've seen? by Anonymous Coward · · Score: 0

      I don't normally complain about grammar, but holy hell, you need to learn to use better grammar, its hard to understand what your saying, run-on sentence and extreme comma abuse rocket ship to the moon!

    2. Re:What's the worst you've seen? by Anonymous Coward · · Score: 0

      OP's grammar is fine even if there are too many commas. On the other hand, "you are" should be shortened to "you're" not "your".

    3. Re:What's the worst you've seen? by Anonymous Coward · · Score: 0

      I don't normally complain about grammar, but holy hell, you need to learn to use better grammar, its hard to understand what your saying, run-on sentence and extreme comma abuse rocket ship to the moon!

      Also, you should have used "it's" meaning "it is".

  16. UK's waterstones.com book store by Anonymous Coward · · Score: 0

    They have also stored passwords in clear text for years now. They don't give a crap about complaints either.

    I think it's book store mentality - at my former job we worked for a french book store chain and they insisted they wanted that "feature", too, because it's "more convenient for the customer". We did not comply with that demand, but it illustrates the point that these people do not want to see reason.

  17. Re: Name and Shame - Try Holiday Inn by Anonymous Coward · · Score: 0

    Holiday Innâ(TM)s IHG Rewards Club. Yes, theyâ(TM)ll mail it to you in plaintext, and by the way: itâ(TM)s only a 4-DIGIT NUMERIC PIN.

    Iâ(TM)ve emailed and otherwise tried their âoecontact usâ links several times over the last several years calling them out over their lack of security. Iâ(TM)ve never gotten anything more than an automated response.

    Apparently their website developers didnâ(TM)t stay at a Holiday Inn Express last night.

  18. Re: Name and Shame - Try Holiday Inn by Anonymous Coward · · Score: 0

    Please keep your mouth closed while posting to Slashdot. Your drool is dripping on your keyboard, randomly shorting it out...

  19. Reply from SEDC to Utilities by mykelfurman · · Score: 1

    "To all SEDC Customers: SEDC is aware of all the facts and timelines regarding the subject of this story. We have taken steps to address the situation. In terms of SEDC’s approach in dealing with this issue, SEDC refrained from speaking in detail about confidential elements of SEDC’s database and software with an unknown 3rd party as doing so could have potentially compromised our customers’ systems. There are No Violations The plain text password in question is not a violation of PCI-DSS (Payment Card Industry Data Security Standard) compliance. This was confirmed with SEDC’s independent PCI Assessor. SEDC is not in violation of any PCI-DSS requirements. There was No Breach There was no breach of any consumer’s data We are Making It Better We notified all of our utilities in December of the software fix (Version 37 Service Pack 5—Enhanced Customer Portal Security Feature) which created an expiring password reset link and it is already deployed to all customers. With this fix, the “forgot password” process creates an expiring change password link that requires the consumer to confirm their identity. This security enhancement removes the option of emailing an existing password to the consumer. Phase 2 of the fix (salting and hashing of the passwords) will be included in Version 37 Service Pack 6 which is currently in beta. These fixes apply to UPN in all versions. SEDC leverages Oracle Advanced Security product to encrypt the entire database using Transparent Data Encryption. Oracle Advanced Security is and has been for quite some time available to all SEDC customers as part of SEDC’s offerings. On behalf of all the management and employees of SEDC, we sincerely apologize for any disruption that the ArsTechnica article may have caused your organization. SEDC is committed to deliver continuous improvement working side by side with our customers." As one of their customers let me be very clear in that SEDC is one of our most trusted vendors and they continually and reliably outshine every other vendor we have come in contact with or deal with. This includes firms that specialize in cyber-security.

    1. Re: Reply from SEDC to Utilities by Anonymous Coward · · Score: 0

      âoeapologize for any disruption that the ArsTechnica article may have causedâ

      Asshats.

  20. Is there a list of affected banks? by Anonymous Coward · · Score: 0

    1-Going through bank there's no "convenience fee" to pay.

    2-Debit card would work, but a credit card with it's benefits and protections would be better.

  21. The PCI Assessor is full of shit by Khyber · · Score: 1

    "The plain text password in question is not a violation of PCI-DSS compliance."

    https://pcipolicyportal.com/bl...

    Requirement 8, version 3.0 of the PCI-DSS spec requires that "Passwords are protected with strong cryptography during transmission and storage."

    --
    Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    1. Re:The PCI Assessor is full of shit by Anonymous Coward · · Score: 0

      Assessors are like doctors. Most are honest, but if you shop around you'll find the cheap, shady ones that'll just sign off on whatever you want.

  22. Another offender by Anonymous Coward · · Score: 0

    Posting as a coward, because I work in the industry. Storing passwords as plain text is very common. Utility billing software from NISC (https://www.nisc.coop/ivue-appsuite/) stores customer passwords in plaintext as well. If your utility provider website is called anything with "Smarthub" in the name, you are vulnerable. These systems also often store email addresses, verification questions, home addresses (including prior addresses), social security numbers, and even family relationships.

  23. Simple google search finds list of companies by kevink707 · · Score: 1

    Doing a Google search for "you may choose to have your password e-mailed to you" (including quotes) gives 160 results, most of which appear to be utility companies.

  24. Worked somewhere that did this.. by Anonymous Coward · · Score: 0

    An MLS software company that I used to work for did this. I told them, many, MANY times how awful this was and that as soon as somebody security-conscious got wind of this, it could ruin them as a company. They didn't care, and instead doubled-down on the practice saying that agents being able to retrieve their password that they forgot was more important....as if there aren't already ways to work around idiots not being able to remember their password..

  25. Not quite by JoePete · · Score: 1

    Some interesting research, and while I agree with the premise that if a site can email you your password, it has substandard security, it does not mean those passwords are stored in plaintext. It's very possible that the passwords are stored in some encrypted form and the process for emailing the password has the resources to decrypt the password. Still, that is only marginally better than storing the password in plaintext. The issue is not how the password is stored (encrypted or not); it is the fact that the password is stored at all. Good systems use a hash of the password. While it is a common misconception, hashing is not encrypting. It is the irreversible conversion of data into a unique representation of that data. This where the regulators fall down. They mistake hashing for encrypting. Even then they fail understand the value of salting a hash (hint, it has nothing to do with table-top seasoning).

  26. There's a punchline too... by CBob · · Score: 1

    https://www.sedata.com/our-sol...

    It includes:
    Cyber Awareness Education
    And....
    SEDC MSS (Managed Security Services)

    Just like a certain D (huge (only a minor bearch) consultancy), mebbe they don't need to do the stuff they tell you to do.

  27. Re:Not Surprised by Anonymous Coward · · Score: 0

    why is this ?