Someone should send a friendly email to each of those offenders, linking the ruling. It's also fair to say that the next few years will be a busy time for the government agencies tasked with GDRP enforcement. (Assuming they do it properly, which falls within the responsibility of the relevant country)
They should, though assuming a bloated org structure and process, fixing it now is probably more expensive than the €20000 fine.
But the fine would have been more if they had refused to fix it. So the calculus isn’t straightforward.
I've looked at many of those Tumblr posts; most of them show that the website sends you a welcome email with your password in plain text, which is bad practice, but doesn't prove that the password is stored in plain text in the database.
But which proves that access to the website codebase will grant you access to those passwords.
Access to the code base, gives you access to the login form. And gives access to all data.
I see this is based on a Spiegel article. Can someone link to the full ruling? One thing I am curious about is how the number was derived. Regardless, even if you disagree with the scope of the law (which I do but not the intent of course), it is a very welcoming sign to see some actual enforcement happening. An under/subjectively enforced law of this size is much worse than a reasonably enforced one.
Here's the Data Protection Officer's press release (in German): https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... - the relevant paragraph is towards the end. The tl;dr is that the fine is rather low because they were very cooperative and quick to follow suggestions for improvement, and have additional improvements planned. Also, they likely couldn't afford more, and the goal of GDPR fines is not only t…
I think the cost of complying with the law is just cost of conducting a business lawfully. So, those parts should not be spoken of as if they were part of the damages.
In my experience, this is mostly what the GDPR is. There is no excuse for storing plaintext passwords in 2014+ and 20k is a fair fine for a mid-size company.
€20k doesn't seem much to me. Cheaper than taking on a security consultant. Not that you need a security consultant to know passwords shouldn't be stored (at all, nevermind plaintext). If they're doing that then they're likely being sloppy elsewhere, and by only paying €20k across the last n years they might have saved a €million. If your company is in the same boat probably worth not bothering to get any security is…
The fine is small since they completely complied with all inquiries and took proper steps to inform users and improve security. Thus do what the actual goals is. Making money is no a goal of GDPR, but ensuring data safety.
In my experience, this is mostly what the GDPR is. There is no excuse for storing plaintext passwords in 2014+ and 20k is a fair fine for a mid-size company.
€20k doesn't seem much to me. Cheaper than taking on a security consultant. Not that you need a security consultant to know passwords shouldn't be stored (at all, nevermind plaintext). If they're doing that then they're likely being sloppy elsewhere, and by only paying €20k across the last n years they might have saved a €million. If your company is in the same boat probably worth not bothering to get any security is…
Well, the fine is only 20k€ because they were very cooperative, quick to fix the worst issues, and promised to continue improving their security further. According to the Data Protection Officer's statement their total expenses were in the six figures. They also explicitly state that the fine wasn't higher as not to place a disproportionate burden on the company's finances, which probably means that they wouldn't have been able to afford a significantly higher fine. Contrary to the fear-mongering on this site, the purpose of GDPR isn't to fine companies out of existence.
I've looked at many of those Tumblr posts; most of them show that the website sends you a welcome email with your password in plain text, which is bad practice, but doesn't prove that the password is stored in plain text in the database.
But which proves that access to the website codebase will grant you access to those passwords.
No. I've implemented precisely that and it doesn't prove what you think.
What you do is have one single function create the user, pick a random password, set it in the database (which in my case uses a perfectly sensible hash) and send the user email. The cleartext password in the mail comes from the function's local string variable, not from the database.
Whether doing this is a good idea is another question. IMO it usually isn't. But this kind of mail does not prove cleartext access.
Full list of 5000+ websites that store their passwords in plain text: https://github.com/plaintextoffenders/plaintextoffenders/blo...
I've looked at many of those Tumblr posts; most of them show that the website sends you a welcome email with your password in plain text, which is bad practice, but doesn't prove that the password is stored in plain text in the database.
The discover card email reads "Here's your _existing_ password".
Here's the Data Protection Officer's press release (in German): https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... - the relevant paragraph is towards the end. The tl;dr is that the fine is rather low because they were very cooperative and quick to follow suggestions for improvement, and have additional improvements planned. Also, they likely couldn't afford more, and the goal of GDPR fines is not only t…
I think the cost of complying with the law is just cost of conducting a business lawfully. So, those parts should not be spoken of as if they were part of the damages.
Well obviously they should have improved their security practices years ago. Nonetheless, they incurred the costs now, as a result of self-reporting a data breach (which is mandatory). That's the number that's relevant as a deterrent for others, so I think it's fine to report it this way.
"Knuddels is safer than ever." Corporate speak is just so funny. The bar for "safer than ever" is pretty low when your dev team hasn't heard of password hashing.
The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...