Why is this a big deal? Hiring a contractor is 100% more insecure than this. I’m not recommending you do it, but it’s basically just people celebrating they now how to do this, but it’s actually never been exploited once in human history. Yet big brain security people trust contractors to write code and nobody bats an eye.
Major Toronto Utility Company Stores Customers' Passwords in Plain Text
11–20 of 89 posts
Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#12This is bad for anyone who recycles passwords. Most everyone I guess. I’m sure they aren’t the only company to do so I don’t think having an online account with your utility provider is required or smart. Good old postal mail is the way.
Paying by checks through the mail is so annoying and difficult to stay on top of. I can't understand how you would prefer that approach in general -- is there some strategy here that I'm missing? Or is it that you open mail always immediately when you receive it, and minimize changes in address / vacations? My strategy is to have a "disposable" password that you use for low-value purposes, like paying utilities. I as…
My guess as to what OP means: postal mail, as in, mail me my bill. And then pay electronically through your bank, not the company’s online portal. At least that’s the way I do it.
Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#13I wonder if they in-housed this or paid some external contractor obscene amounts of money for it?
Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#14This is bad for anyone who recycles passwords. Most everyone I guess. I’m sure they aren’t the only company to do so I don’t think having an online account with your utility provider is required or smart. Good old postal mail is the way.
Paying by checks through the mail is so annoying and difficult to stay on top of. I can't understand how you would prefer that approach in general -- is there some strategy here that I'm missing? Or is it that you open mail always immediately when you receive it, and minimize changes in address / vacations? My strategy is to have a "disposable" password that you use for low-value purposes, like paying utilities. I as…
Do you really want to bank on your utility to have their shit figured out so you don't pay the utility bill for your whole town? Even if you do entirely get it resolved, that seems like extra hassle when you could just... use a password manager.
Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#15Why is this a big deal? Hiring a contractor is 100% more insecure than this. I’m not recommending you do it, but it’s basically just people celebrating they now how to do this, but it’s actually never been exploited once in human history. Yet big brain security people trust contractors to write code and nobody bats an eye.
This is an attack called "credential stuffing" and the OWASP page for it has multiple examples of it being used in the real world: https://owasp.org/www-community/attacks/Credential_stuffing .
Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#16Great. Now all I need is someone to hack my account and pay my electricity bill for me.
I think the vector I'd be more worried about here is that someone does a database dump of usernames & passwords, and then proceeds to use that data for credential stuffing. The hygenie of users being on average probably "not great", that would probably lead to subsequent compromise down the line, of things more valuable than the electric company's account.
But, IDK, if they're storing passwords in the clear — something so trivial to get right, and so obviously not best practice — I'd also be wondering if the user's bank account routing & account numbers aren't in that same database table…? I can imagine some damage from that.
Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#17Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#18This is a misunderstanding. The CS agent has access to a plaintext (security question) password that can be used under special circumstances. It must be readable to function.
Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#19This is a misunderstanding. The CS agent has access to a plaintext (security question) password that can be used under special circumstances. It must be readable to function.
Nice try, Toronto Hydro
Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text
#20Toronto Hydro isn't just "a major utility company" It is entirely government owned and the largest electricity provider in the province.
It’s been a while since I’ve lived in Toronto but I’m pretty sure neither of your points is correct.
I believe you’re thinking of Ontario Hydro, though it looks like that’s been privatized and/or split up.