Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virgin Media (UK) stores passwords in plain text, sends them through the mail

twitter.com

Post reply on HN
Print view View original

1–10 of 55 posts

Re: Virgin Media (UK) stores passwords in plain text, sends them through the mail

#2

Post by shakna »

> Posting it to you is secure, as it's illegal to open someone else's mail. ^JGS (@virginmedia)

> There are a number of additional considerations you will need to take account of when designing your password system, such as the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defending against common attacks and the use of two-factor authentication. [0]

Well, they're not admitting what they do is in any way unsafe, but it really seems like a cut-and-dried GDPR violation.

They really haven't met even the spirit of:

> Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

[0] https://ico.org.uk/for-organisations/guide-to-data-protectio...

Re: Virgin Media (UK) stores passwords in plain text, sends them through the mail

#3

Post by wutbrodo »

I learned a long time ago that the default assumption for non-tech-first companies should be deep, deep incompetence, below the level of an undergrad with a decent CS degree, when it comes to basic security practice. Even having your system be Incredibly Important isn't enough to force basic competence: there were plenty of government and bank systems through the 2000s that were apparently designed and maintained by high school kids (looking at you Citibank).

By 2019, a lot of the industries running more critical systems like finance have figured out that you should take your tech seriously (and it only took them twenty years to figure it out...) ,but it's still a pretty good baseline assumption.

Re: Virgin Media (UK) stores passwords in plain text, sends them through the mail

#5

Post by jayflux »

I get everyone replying to virgins Twitter account in disgust, but let’s be honest, the person on the other end of that most likely won’t be technical, nor will there be much chance of them relaying it on. They will reply then go home for the day.

This is where things like https://securitytxt.org/ are important. Being able to go through to the team or person who knows what’s going on. But then again, if a company stores plain text passwords they most likely won’t have security.txt

Re: Virgin Media (UK) stores passwords in plain text, sends them through the mail

#7

Post by nkrisc »

shakna wrote: post #2

> Posting it to you is secure, as it's illegal to open someone else's mail. ^JGS (@virginmedia) > There are a number of additional considerations you will need to take account of when designing your password system, such as the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defending against common attacks and the use of two-factor authentic…

Perhaps users can pay their bills by leaving a bag of cash in the park with "Virgin Media" written on it, as it would be illegal for anyone else to take it.

Re: Virgin Media (UK) stores passwords in plain text, sends them through the mail

#8

Post by DanBC »

shakna wrote: post #2

> Posting it to you is secure, as it's illegal to open someone else's mail. ^JGS (@virginmedia) > There are a number of additional considerations you will need to take account of when designing your password system, such as the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defending against common attacks and the use of two-factor authentic…

VM even got the mail law a bit wrong.

The relevant law is the Postal Services Act 2000, section 84(3)

If the letter has already been delivered, maybe to the wrong address, it's only an offence to open that letter if you have the intent to cause detriment and you don't have an excuse to open it.

"Hey this looks important and I wonder who it's for" is a reasonable excuse to open the letter.

https://www.legislation.gov.uk/ukpga/2000/26/contents

https://www.legislation.gov.uk/ukpga/2000/26/part/V/crosshea...

> 3)A person commits an offence if, intending to act to a person’s detriment and without reasonable excuse, he opens a postal packet which he knows or reasonably suspects has been incorrectly delivered to him.

Post reply on HN