from Hacker News

Ask HN: How to out a MAJOR online company storing passwords in plaintext?

by dwelch2344 on 6/1/15, 1:01 AM with 14 comments

I recently became aware of a major online hotel broker that stores passwords as plaintext in their system. The management is aware of the technical risks and liabilities but has pushed off technical fixes for YEARS. Furthermore, the features of the website make it obvious that this could be q very valuable attack vector as the reset feature emails you your current plain text password.

So the question is: what is the ethical way to raise the issue and force their hand in a fix?

(Sorry for brevity and spelling; mobile on holiday)

  • by paulhauggis on 6/1/15, 1:31 AM

    How do you know it's actually plain text? There are plenty of 2-way encryption methods out there.

    Do you work there? If so, are you willing to lose your job over it?

    These sorts of leaks can have devastating effects on the company/customers. You should also think about the employees that work there as well. Are you willing to risk their jobs in the event that the company loses money?

  • by dublinben on 6/1/15, 3:59 AM

    Anonymously report to plaintextoffenders.com?