Lessons in website security anti-patterns by Tesco
1–10 of 120 posts
Re: Lessons in website security anti-patterns by Tesco
#2I watched this exchange occur over Twitter on the weekend; the worst part of it was not that Tesco stores the password in a reversible manner, but that their representative actively defended their mechanism.
Otherwise, all of their other "crimes" (cookies are sent unencrypted, etc) are bad but not really unexpected from a large chain like this. I'm never really surprised when large organisations get these things so wrong, given the way many either contract this work out and/or [mis]handle it in-house.
Re: Lessons in website security anti-patterns by Tesco
#3I don't think it's fair to expect a customer service representative to understand the issue here. Maybe it might be better to go through Tesco's corporate arm? I just tried submitting something through the feedback form on the front page of Tesco.com, perhaps this has a better chance of reaching somebody in a position to actually do something about it.
Re: Lessons in website security anti-patterns by Tesco
#4I watched this exchange occur over Twitter on the weekend; the worst part of it was not that Tesco stores the password in a reversible manner, but that their representative actively defended their mechanism. Otherwise, all of their other "crimes" (cookies are sent unencrypted, etc) are bad but not really unexpected from a large chain like this. I'm never really surprised when large organisations get these things so w…
If it was the weekend, it seems unlikely to me that the person running the Twitter account would have got in touch with someone with a technical understanding of how the site works. More likely they just consulted their list of talking points and picked the ones that looked most relevant to the situation.
Re: Lessons in website security anti-patterns by Tesco
#5I watched this exchange occur over Twitter on the weekend; the worst part of it was not that Tesco stores the password in a reversible manner, but that their representative actively defended their mechanism. Otherwise, all of their other "crimes" (cookies are sent unencrypted, etc) are bad but not really unexpected from a large chain like this. I'm never really surprised when large organisations get these things so w…
If it was the weekend, it seems unlikely to me that the person running the Twitter account would have got in touch with someone with a technical understanding of how the site works. More likely they just consulted their list of talking points and picked the ones that looked most relevant to the situation.
On the other hand, the sensible thing to do would be to say something like “Can you provide your contact details in a DM: we’ll get one of our tech guys to contact you on Monday”
Re: Lessons in website security anti-patterns by Tesco
#6I think it's safe to assume that they outsourced this aspect of their online service, given the quality of the copy in some of the pages.
Re: Lessons in website security anti-patterns by Tesco
#7It boggles my mind that this is STILL happening. How many leaked databases of plain text passwords, not to mention 'point and shoot' tools like firesheep, will it take before companies start taking security seriously?
Yes it's possible they two way encrypt their passwords, but that's still not as secure as salted hashes, not to mention all the other security blunders.
Re: Lessons in website security anti-patterns by Tesco
#8I discovered this a couple of years ago and emailed and got an unsatisfactory response:
Hopefully this new attention will have them change the policy.
Re: Lessons in website security anti-patterns by Tesco
#9This is a hilarious, albeit depressing, view of the state of cyber security as seen by the general public. People, even those who are generally considered computer literate, don't have any understanding of web security. Due to this, Tesco won't hit any negative publicity outside of a tight knit circle of programmers. In fact, saying that everything is "stored securely" according to "industry standards" would reassure most people.
There have been many calls in past exploit threads for a name and shame policy, but that won't do anything. Name and shame only works when people keep up with the list, and people won't. They're too busy with their lives to focus on a list, especially given the number of insecure websites around the world.
We need everyone to have a list of easy to remember rules about web security from a consumer perspective. This list of rules needs to reach everyone. Putting them in the browsers may lead to the exposure needed, but I don't see that happening.
This primitive level of education needs to start breaking through as it's only going to get worse as computing and security advance further. We haven't even finished explaining to people that plain text passwords almost always indicate impending disaster, yet we already need a way to explain MD5 is never enough and SHA256 isn't enough without a salt...
Re: Lessons in website security anti-patterns by Tesco
#10I don't think it's fair to expect a customer service representative to understand the issue here. Maybe it might be better to go through Tesco's corporate arm? I just tried submitting something through the feedback form on the front page of Tesco.com, perhaps this has a better chance of reaching somebody in a position to actually do something about it.
I totally agree, which of course is why they shouldn't be commenting on it! But regardless of the Customer Care's Twitter account, their messaging is consistent with the misunderstandings demonstrated throughout the website.