21–30 of 120 posts
I discovered this a couple of years ago and emailed and got an unsatisfactory response: http://pastebin.com/C745weQ2 Hopefully this new attention will have them change the policy.
I don't think it's fair to expect a customer service representative to understand the issue here. Maybe it might be better to go through Tesco's corporate arm? I just tried submitting something through the feedback form on the front page of Tesco.com, perhaps this has a better chance of reaching somebody in a position to actually do something about it.
And yet, they have a very clued up technology department led by Nick Lansley, which many years ago opened up a public API to access to Tesco online shopping.
This does not excuse this lapse, but it may help us understand why if a computer system seems to work fine, they have little motivation to replace, upgrade or fix it, even if it is running on an old version of the platform.
And yet, they have a very clued up technology department led by Nick Lansley, which many years ago opened up a public API to access to Tesco online shopping.
You can do case-insensitive passwords with hashing/salting. It's just a matter of lower-casing the password before hashing it. (Edit: I'm not saying this is a good idea, of course!!)
I remember reading once that Facebook actually hashes multiple versions of your password (eg with the first letter upper-cased to handle the case where a phone auto-corrects it, and also with all character cases toggled to handle the case when you left caps lock on). I wonder if there's any statistics about how often this kind of thing actually helps?
Of course, it seems pretty clear in this particular case that Troy is right and they're just storing your password in a case-insensitive database column.
It boggles my mind that this is STILL happening. How many leaked databases of plain text passwords, not to mention 'point and shoot' tools like firesheep, will it take before companies start taking security seriously? Yes it's possible they two way encrypt their passwords, but that's still not as secure as salted hashes, not to mention all the other security blunders.
Of course, you shouldn't do it, unless you have a good reason. E.g. There was talk a few months ago about a new law being proposed in France requiring companies to provide the police with user passwords.
Earlier quoted context omitted.
If only Google Chrome would start warning users on signup that their password would be stored in plain text.
Google Chrome and the Google search engine warn you if a website contains malware or is suspected of phishing. Poor security is just as dangerous as these, the only thing missing is the malicious intent. Unfortunately, Google would likely open themselves to lawsuits if they warned users away from or penalised websites due to poor security.
Tesco are fundamentally in the business of selling meat and potatoes to everyone in the UK, not of making highly-secure websites. This does not excuse this lapse, but it may help us understand why if a computer system seems to work fine, they have little motivation to replace, upgrade or fix it, even if it is running on an old version of the platform.
Tesco are fundamentally in the business of selling meat and potatoes to everyone in the UK, not of making highly-secure websites. This does not excuse this lapse, but it may help us understand why if a computer system seems to work fine, they have little motivation to replace, upgrade or fix it, even if it is running on an old version of the platform.
They are a huge online retailer in the UK, that should automatically mean their website is highly secure. It has my address and credit card details in it!
You'd think so, but apparently that's not how it's working out.