Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons in website security anti-patterns by Tesco

troyhunt.com

Post reply on HN
Print view View original

41–50 of 120 posts

Re: Lessons in website security anti-patterns by Tesco

#41

Post by patrickk »

Smerity wrote: post #9

This is a hilarious, albeit depressing, view of the state of cyber security as seen by the general public. People, even those who are generally considered computer literate, don't have any understanding of web security. Due to this, Tesco won't hit any negative publicity outside of a tight knit circle of programmers. In fact, saying that everything is "stored securely" according to "industry standards" would reassure…

Maybe the solution is for a 'white hat' hacker to hack them, send them an email (oh btw here's the usernames and passwords of thousands of your customers). That might light a fire under their ass.

Edit: And publicly blog about it to shame them into action.

Re: Lessons in website security anti-patterns by Tesco

#42

Post by TazeTSchnitzel »

AncientPC wrote: post #33

It's fun to bash on the most recent security naiveté, but can someone explain why GNU Mailman still emails users' passwords after subscribing? Mailman warns users that passwords will be mailed plaintext, but why mail passwords to begin with?

Because nobody has patched it. Go there, download the source, write a patch, submit it.

Re: Lessons in website security anti-patterns by Tesco

#43

Post by legutierr »

chrisacky wrote: post #14

Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at http://www.realestate.com.au/ Just to refresh your memory.. https://twitter.com/#!/realestate_au/status/2207319148043059... Anyway, "we are aware of this issue and are working on it". Click http://www.realestate.com.au/ then "Register". Then stand in utter amazement at their solution. ----------------------------------------…

Do you know who else does this? The US Department of Labor when you register/reset/change your password with the PERM system.

Re: Lessons in website security anti-patterns by Tesco

#44

Post by klmr »

… and then he goes and recommends 1Password, a closed-source “security” software. Yes, I’m one to talk, I’m using the OS X password manager. But I wouldn’t recommended it in a security blog.

Sadly, 1Password is probably the best solution there currently is. But this only shows how abysmal the current state of affairs is for security.

Re: Lessons in website security anti-patterns by Tesco

#45

Post by tomgallard »

jrsimmons wrote: post #36
lengarvey wrote: post #20

Earlier quoted context omitted.

In slight defense of that horrible password practice: You can't really do much with a realestate.com.au account unless you are an Agent (which is a separate account). There's no payment processing, or any way to add content to the site. The accounts there are basically just a way to save common realestate searches as far as I can tell.

Yeah, no. All private user information is equally private. To arbitrarily suggest that certain data is less important is a dangerous road to walk down. We should be holding everyone to the same standards when it comes to security. This is especially true with the high amount of password reuse that goes on.

I'm not sure I agree. I'd say my name is private, I'd say my date of birth is more private, I'd say my medical conditions are more private still. There are clearly degrees of privacy.

Does it really make sense to hold my bank to the same standard as a real estate website? Sure they should all reach some minimum requirement (salted and hashed passwords), but I expect my bank to have far higher standards (e.g. two factor auth) than a a random site.

Re: Lessons in website security anti-patterns by Tesco

#46

Post by sp332 »

jrsimmons wrote: post #36
lengarvey wrote: post #20

Earlier quoted context omitted.

In slight defense of that horrible password practice: You can't really do much with a realestate.com.au account unless you are an Agent (which is a separate account). There's no payment processing, or any way to add content to the site. The accounts there are basically just a way to save common realestate searches as far as I can tell.

Yeah, no. All private user information is equally private. To arbitrarily suggest that certain data is less important is a dangerous road to walk down. We should be holding everyone to the same standards when it comes to security. This is especially true with the high amount of password reuse that goes on.

This is clearly not true, or HIPPA would apply to my street address, and sites that want my phone number would have to be PCI compliant.

Re: Lessons in website security anti-patterns by Tesco

#47

Post by pmjordan »

tomgallard wrote: post #45
jrsimmons wrote: post #36

Earlier quoted context omitted.

Yeah, no. All private user information is equally private. To arbitrarily suggest that certain data is less important is a dangerous road to walk down. We should be holding everyone to the same standards when it comes to security. This is especially true with the high amount of password reuse that goes on.

I'm not sure I agree. I'd say my name is private, I'd say my date of birth is more private, I'd say my medical conditions are more private still. There are clearly degrees of privacy. Does it really make sense to hold my bank to the same standard as a real estate website? Sure they should all reach some minimum requirement (salted and hashed passwords), but I expect my bank to have far higher standards (e.g. two fact…

The problem with storing passwords insecurely is that people reuse them. You can try to tell them otherwise as much as you like, they will do it, so even if one service holds non-sensitive data, stealing the password will grant access to other, completely unrelated services.

Re: Lessons in website security anti-patterns by Tesco

#49

Post by Wilya »

chrisacky wrote: post #14

Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at http://www.realestate.com.au/ Just to refresh your memory.. https://twitter.com/#!/realestate_au/status/2207319148043059... Anyway, "we are aware of this issue and are working on it". Click http://www.realestate.com.au/ then "Register". Then stand in utter amazement at their solution. ----------------------------------------…

Well, let's look at the good side of it. At least it limits the risks of password reuse.

Re: Lessons in website security anti-patterns by Tesco

#50

Post by albahk »

chrisacky wrote: post #14

Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at http://www.realestate.com.au/ Just to refresh your memory.. https://twitter.com/#!/realestate_au/status/2207319148043059... Anyway, "we are aware of this issue and are working on it". Click http://www.realestate.com.au/ then "Register". Then stand in utter amazement at their solution. ----------------------------------------…

As far as I know, realestate.com.au is not owned by Homeaway.com - its listed on the ASX under REA Group http://en.wikipedia.org/wiki/REA_Group
Post reply on HN