Plain wrong: Millions of utility customers’ passwords stored in plain text

guest · Feb 25, 2019

Plain wrong: Millions of utility customers’ passwords stored in plain text
"It's ridiculous vendors are replying to researchers via general counsel, not bug bounty."
February 25, 2019
https://arstechnica.com/tech-policy...ity-customers-passwords-stored-in-plain-text/

In September of 2018, an anonymous independent security researcher (who we'll call X) noticed that their power company's website was offering to email—not reset!—lost account passwords to forgetful users.

This was frustrating and insecure, and it shouldn't have happened at all in 2018. But this turned out to be a flaw common to websites designed by the Atlanta firm SEDC.
Plain-text passwords
X did not attempt to discover any direct exploits into any of the utility firms or into SEDC's own payment site.
Is this a PCI-DSS problem?
There's a fair bit to chew on here. X believed that by storing customer passwords in plain text, SEDC could be violating PCI-DSS, the industry regulations governing storage of customer billing information. Cole objected strenuously—and very directly—to this idea.
Click to expand...

Where things stand now
Many of SEDC's client firms have been patched to some degree in the last couple of weeks.
Cole's final correspondence with X is both careful and cagey. It says, in part:

[...] Given that there has been no PCI violation nor any indication of third party access to anyone’s PII (in fact, the plain-text password at issue does not enable such access), it is unclear what “disclosure” you think should be made, much less under what authority you think such a disclosure would be required.
What Mr. Cole did not say is that "the passwords are now encrypted," let alone that "they are encrypted now, using a strong hash, with cryptographic salt unique to each record."
Click to expand...

Minimalist · Aug 4, 2019

Why Are Companies Still Storing Passwords In Plain Text?

Several companies have recently admitted to storing passwords in plain-text format. That’s like storing a password in Notepad and saving it as a .txt file. Passwords should be salted and hashed for security, so why isn’t that happening in 2019?
Click to expand...

https://www.howtogeek.com/434930/why-are-companies-still-storing-passwords-in-plain-text/

Log in or Sign up

Plain wrong: Millions of utility customers’ passwords stored in plain text

guest Guest

Minimalist Registered Member

Log in or Sign up

Plain wrong: Millions of utility customers’ passwords stored in plain text

guest Guest

Minimalist Registered Member

Useful Searches