51–60 of 120 posts
This reminds me of "Our security auditor is an idiot. How do I give him the information he wants?" --> http://serverfault.com/questions/293217/our-security-auditor... Have anyone seen this? :-)
I considered writing / emailing but didn't think it would do much good.
Earlier quoted context omitted.
They are a huge online retailer in the UK, that should automatically mean their website is highly secure. It has my address and credit card details in it!
> They are a huge online retailer in the UK, that should automatically mean their website is highly secure. You'd think so, but apparently that's not how it's working out.
This is a hilarious, albeit depressing, view of the state of cyber security as seen by the general public. People, even those who are generally considered computer literate, don't have any understanding of web security. Due to this, Tesco won't hit any negative publicity outside of a tight knit circle of programmers. In fact, saying that everything is "stored securely" according to "industry standards" would reassure…
Maybe the solution is for a 'white hat' hacker to hack them, send them an email (oh btw here's the usernames and passwords of thousands of your customers). That might light a fire under their ass. Edit: And publicly blog about it to shame them into action.
Great analysis except I'm puzzled by his claim about trace.axd -- is it really a security risk that tracing is enabled, given that it can only be accessed from the local machine?
Tesco are fundamentally in the business of selling meat and potatoes to everyone in the UK, not of making highly-secure websites. This does not excuse this lapse, but it may help us understand why if a computer system seems to work fine, they have little motivation to replace, upgrade or fix it, even if it is running on an old version of the platform.
That is changing - it is getting to the point where their business angle is more "renting shelf space to brands" as much as selling what we want to buy (that is a general industry thing, not a Tesco specific comment).
Even ignoring that cynicism, their business is far more than food and I suspect the food sales are dwarfed when you add everything else together. Food is just the product that gets us through the door to see the other stuff: meat, veg, bread and milk are the things that the rest of the occupants of large shopping centres tend to lack.
> not [in the business] of making highly-secure websites.
On the contrary: they are taking in and storing personal details and in some cases banking details (they sell banking services as well as physical products), and getting access to your account may give someone the ability to buy things on your credit card. It is my understanding that both by law and by the agreements they have in place with their chose credit card processing partners they are required to live up to certain security expectations, and if they do not live up to those expectations they should be investigated, fined, and stopped from trading in those ways until they are up to scratch.
The claim that their password storage is "up to industry standards" is both unduly vague (though as the conversation was by tweet the length limitation there may be partly to blame for that) and simply wrong. They are not compliant with PCIDSS (http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...) which I believe is considered the industry standard for handling credit card data or accounts that are associated with it.
Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at http://www.realestate.com.au/ Just to refresh your memory.. https://twitter.com/#!/realestate_au/status/2207319148043059... Anyway, "we are aware of this issue and are working on it". Click http://www.realestate.com.au/ then "Register". Then stand in utter amazement at their solution. ----------------------------------------…
This is a hilarious, albeit depressing, view of the state of cyber security as seen by the general public. People, even those who are generally considered computer literate, don't have any understanding of web security. Due to this, Tesco won't hit any negative publicity outside of a tight knit circle of programmers. In fact, saying that everything is "stored securely" according to "industry standards" would reassure…
While training your staff won't solve all your security problems, I still think it'll help mitigate a lot of them.
Tesco are fundamentally in the business of selling meat and potatoes to everyone in the UK, not of making highly-secure websites. This does not excuse this lapse, but it may help us understand why if a computer system seems to work fine, they have little motivation to replace, upgrade or fix it, even if it is running on an old version of the platform.
> Tesco are fundamentally in the business of selling meat and potatoes to everyone in the UK That is changing - it is getting to the point where their business angle is more "renting shelf space to brands" as much as selling what we want to buy (that is a general industry thing, not a Tesco specific comment). Even ignoring that cynicism, their business is far more than food and I suspect the food sales are dwarfed wh…
However I am not finding anything about "you may not store passwords in plain text or using reversible encryption" in that PCIDSS wikipedia link. If it is part of the standard (as it should be) then it deserves to be in the wikipedia article.