Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Starbucks caught storing mobile passwords in clear text

computerworld.com

Post reply on HN
Print view View original

11–20 of 54 posts

Re: Starbucks caught storing mobile passwords in clear text

#11

Post by troebr »

eli wrote: post #8

Storing a token isn't really much more secure than storing the password itself. (If I steal your token, I'm buying coffee with your account even though I don't know your password. A token that authenticates account access is a password.) But it seems much more secure (which, it turns out, matters) and it does somewhat protect people who reuse the same password everywhere.

You can invalidate tokens for a compromised phone. Well you can also change your password, but I'd rather revoke the access from my phone than have my password stolen. Some kind of validation mechanism before you order could be nice (like a screen lock), something you can do with one hand.

Re: Starbucks caught storing mobile passwords in clear text

#13

Post by nickflees »

The assertion that users can make unlimited purchases after entering credentials just once is false: "Customers need only enter their password once when activating the payment portion of the app and then use the app to make unlimited purchases without having to key in the password or username again."

That is, unless you have automatic reloading on, which is a crucial point. This doesn't excuse the practice of storing passwords in clear text, but it's an important detail.

Re: Starbucks caught storing mobile passwords in clear text

#14

Post by annnnd »

brudgers wrote: post #5

"If you grab someone's phone, you can effectively go through this log and see effectively where this person has been," Wood said. "It's a bad thing for user privacy" Compared to what? The implicit assumption is that Starbucks gathering and storing geolocation data is not a potential invasion of privacy or a meaningful risk. The person who steals my iPhone is very unlikely to do so for the data it contains. Their goal…

Exactly!

Also, is it safer having the password saved on your phone in cleartext, or is it safer if user has to enter it every time in front of strangers?

Re: Starbucks caught storing mobile passwords in clear text

#15

Post by nly »

Every single app on your phone that remembers a username and password combination, or any other credential, is likely vulnerable.

Imho its about time that Google required the presence of a HSM in Android devices for key storage. A HSM that locked me out after ~10 x 6 digit PIN guesses (with software locking me out at a lower number) strikes me as a good thing. If someone wants to destroy my $500 phone, prise out a chip, grind it down, and look at it under an electron microscope to extract my passwords, then good luck to them. Why isn't this happening?

Re: Starbucks caught storing mobile passwords in clear text

#16

Post by ZoFreX »

> Starbucks could have chosen not to store the password on the phone, but users would then be forced to key in their username and password every time they wanted to use the app to make a purchase.

These aren't the only two options. Storing a token would let users remain logged in without having the same security implications as storing the password.

Some advantages of a token vs a password:

1. Lots of users use the same password on multiple sites

2. You could allow common usages via a token but still request a password re-entry for more potentially dangerous actions like changing the email address on the account

3. Tokens can be invalidated, so if the phone is lost the user can disable the app on it without needing to change their password

4. Tokens can be selectively invalidated, so if you have multiple devices you could log some of them out without logging them all out

5. Tokens can be set to expire so you can request password re-entry every so often just to ensure a bad actor would get locked out eventually

Re: Starbucks caught storing mobile passwords in clear text

#17

Post by osteele »

eli wrote: post #8

Storing a token isn't really much more secure than storing the password itself. (If I steal your token, I'm buying coffee with your account even though I don't know your password. A token that authenticates account access is a password.) But it seems much more secure (which, it turns out, matters) and it does somewhat protect people who reuse the same password everywhere.

Many services grant fewer capabilities to a session authenticated only by token. In the case of Starbucks, you can buy a coffee or even reload the card from the user’s bank account via the app, but you need the password and the web site to change the user's mailing address. Therefore, this vulnerability might enable an exploit such as draining your bank account into gift cards that I send to my address, whereas access to your phone and token would not.

Re: Starbucks caught storing mobile passwords in clear text

#18

Post by ctdonath »

jessaustin wrote: post #10

Only when adding money to the app is the password required. This seems precisely backwards.

"Adding money" means applying a credit card to purchase Starbucks credit, usually by a sequence like "Reload card -> $25 -> Confirm" on a pre-stored credit card number. Buying from the app has a small cash pool to draw from; reloading from a CC can get one a whole lot more money.

Re: Starbucks caught storing mobile passwords in clear text

#19

Post by ceejayoz »

jessaustin wrote: post #10

Only when adding money to the app is the password required. This seems precisely backwards.

Why? If they steal my $20 balance I'm out $20. If I've got a card linked to my account and they load it up with $1k and go on a shopping spree, I'm significantly more screwed.

Re: Starbucks caught storing mobile passwords in clear text

#20

Post by dangoldin »

unreal37 wrote: post #4

I sympathize with the developers because I face this maddening argument every day between convenience and security, but storing passwords in plaintext on local. Geez. Make a token on the server after initial login and store that! Not much more secure, but then this story wouldn't be news.

Seriously. Bigger problem is password reuse. If someone gets access to a user's password they then most likely have access to their email account, etc.
Post reply on HN