Seems like they should be criminally responsible for the false claims and unsecured data transfer.
It might be totally unintentional, but they asked for your password and have no warning not to use your real password.
They even stored it after explicitly claiming they wouldnât.
Sounds like it was a pretty good lesson in password security.
Well they would certainly fall foul of the data protection and retention directive in the EU. Not sure if they would end up paying out though.
I suspect that the way it was a one-off and not part of their actual business would mean they wouldnât be fined for it.
They may well be liable in tort if any damage occurs.
On the plus side, apparently the âArcherâ inspired password âeat/a/bag/of/dicksâ is secure enough to last long past the end of the known universe, with a whopping 180 billion years required to break it.
<yoink>'eat/a/bag/of/dicks'</yoink>
(adds to dictionaryâŚ)
But a password isnât much use without a username, is it? Suppose I found out somebody, somewhere, uses password123⌠so what?
Attack dictionaries just got larger, for one.
At the very least, I guess you could add it to the password dictionary used by your password-cracking tool.
Or maybe CNBC or one of the advertisers has a cookie which can identify the person directly.
The stupid⌠it burns.
That one is grade A dumbness of the sort that can get CNBC a class action. Where the hell were the IT security guys on this one? Probably not told and too overworked to notice what somebody set up for a website.
Ok, well this brings me to my favorite work related security anecdote.
For a month at an ex work of mine there were posters up about improving security and the chief security officer was spamming everyone with emails about how to improve security and passwords and whatnot, finally they were going to hold a contest regarding who had the best password so she sent an email asking everyone to send their password, I of course thought it was a joke but I was still insulted so I sent a rude email back and was informed that no, it was definitely real.
The next day she sent an email announcing the winner of the contestâs name and the winning password.
Wow⌠thatâs umm a very special type of security there. How long did you last in that environment?
well I lasted several years until the international project I was working on was done, I just never took any part in workplace contests.
Hey, what a great phishing vector!
I once had a user on an FTP server (which didnât enforce regular password changes) who occasionally needed her password reset. I first time I set it to âchangemeâ and told her to change it right away. The next time I did that she said âoh yeah, that was my old password.â So the next time I changed it to âchangemerightnowâ. And I made a note of the hash so I could see if she changed it. She never did.
So the next time she got âChangeThisPasswordRightNowWendyYouMUSTChangeItToSomethingNewBeforeUsingTheServer.â
A few months later I was in the room when she had to upload something and she complained that the password I gave her was so long to type every time.
Maybe ⌠the advertisers will cross reference with facebook and other tracking cookies?
Incredibly hard to prove, I imagine.
The fraudulent claims and the negligence though, it should be criminal!
Did yâall know that if you type your discourse password in bOINGbOING, it shows up as plaintext to you, but everybody else just sees a row of asterisks? Look, hereâs mine!
******************
Try it, itâs fun!*
Â
Â
* disclaimer: not actually fun, for you.
Medieva1istisaPoopyHead!
Wow, thatâs really cool.
This is fine as long as they say that every password is extremely easy to hack and should be changed immediately.
âYour password is very insecure because you donât know how to safeguard it.â
