A geeky rant that non-geeks really should read
Nice to see that this is finally getting some press...
Tesco web security 'flaw' probed by UK data watchdog, BBC News
Tesco face enquiry over 'lousy' website security, Telegraph
So what's happened? Basically, Troy Hunt, a software architect, discovered a flaw or two in Tesco Online's security a few weeks back. Geeks can read the whole thing here but for the non-technical, if you use Tesco's website your password is being stored on their server in a decryptable way. This is actually provable - go to any website you have to log into, and use the password recovery function. If the function resets your password to something random or allows you to change it to something you can remember, that's good. If it emails you your password, then that's a broken system. Tesco does the latter. If a website stores passwords on a server (which Tesco must do, in order to email it to you) then all it takes is one hacker to get in and all the passwords are compromised. The story has been picked up by numerous IT professionals - including the CTO of Sophos, Graham Cluley - all of whom criticise Tesco's security.
So all Tesco have to do is start encrypting their passwords server-side, and this whole problem will go away. Instead they came out with this tweet:"Passwords are stored in a secure way. They’re only copied into plain text when pasted automatically into a password reminder mail."
This might calm the layman but everyone with even the basic knowledge of computer security will read that sentence and scream at the insanity of it. It's physically impossible to copy a password to plain text if it's actually stored securely. Secure password storage means one-way irreversable encryption (known as 'hashing').
If that didn't annoy me enough, this tweet was the nail in the coffin..."We know how important internet security is to customers and the measures we have are robust." Which is basically the Twitter equivalent of sticking their fingers in their ears and going "la la la I'm not listening."
OK, so Tesco hasn't been hacked. But that doesn't matter - the world now knows that their security is crap, so 10 to 1 there are already malicious hackers targeting them. And when they get in, because Tesco don't hash their passwords, your security as a customer is at stake, and Tesco will only have themselves to blame for sticking their heads in the sand. Letting a massive security flaw like this lie is like not locking your front door when you go out. Sure, you may not get robbed for years but the one day that the burglars do come, they'll get away with everything with very little effort.
There is no such thing as too much security... and no amount of security is ever enough. Especially when you're trusted with the details of thousands of innocent customers.

Seems like my blog's becoming more and more like the telly these days - full of repeats. I will remind you of 