Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not.

If I change the password, it sends a confirmation via email with both userid and password.

The portal has info on all students like birthdays, addresses, grades, etc. It also has information on school events, teacher addresses, etc.

This absolutely feels like they are breaking some rules, but inquiries to the IT Director at the school have not been returned. I plan to escalate but would like to be armed with specifics on true violations and/or risks.

share|improve this question
2  
Since this is a legal question, it is important to know the country. Some countries (such as most of the EU) have much stricter privacy rules than other countries (such as the USA). – Hendrik Brummermann♦ May 28 '12 at 18:01
3  
@HendrikBrummermann - USPS stands for United States Postal Service, so I think its fair to assume USA. – dr jimbob May 28 '12 at 18:55
well if they are sending the password throughout the year it does sound like security is an afterthought for sure. IF the database containing the passwords is encrypted (as it should be) they should not be able to view the plain text of the password. With both being sent in plain text via email and USPS this is a huge risk! – Mark S. May 29 '12 at 12:37
@MarkScrano, just to clarify: passwords should be hashed, not encrypted. – Chris Kuehl Jun 1 '12 at 8:11

3 Answers

up vote 6 down vote

It certainly doesn't sound like best practice, but I'm not sure if it necessarily is violating any laws. I'm guessing you are from the US, so there are data protection laws, but they aren't as defined as we'd like - same as in the UK the guidance tends to use words like 'appropriate protection'.

You should be able to use the argument that if they continue to send paper mail or emails which have both username and password, they could end up suffering not only a big fine, but also have considerable reputational damage. Depending on which state you are in - some require public disclosure of sensitive information, but even if not, parents will pass the word around!

The expectation should be that two messages would have to be intercepted in order to get unauthorised access. And it would be even better if one was by USPS and one by email, thus requiring an attacker to compromise two forms of communication, but that could be overly complex for a school.

share|improve this answer
1  
I work for a company that develops software for the management of universities in Germany. Our legal advise is very clear that transmitting any sensitive information (such as passwords, grades, interests, etc.) via unencrypted channels (such as email) is a violation of Germany privacy law. – Hendrik Brummermann♦ May 28 '12 at 18:05
Agreed. The UK is also strict in the area of personal data protection, but I made the guess that it was the US that was the subject here. – Rory Alsop♦ May 28 '12 at 18:54
Yes, I am in the US and this is a prep school with students from around the US as well as 14 other countries. Absolutely agree that this is bad practice, and plan to escalate, but absolutely wish I had something more concrete like privacy laws. Although, risk of reputation is a big deal in private schools. I can at least take that angle. Thanks for the info! – CathyS May 28 '12 at 21:49
1  
@CathyS - The problem you are going to face is. Some parents want to be able to track their child's grades. If the school was unable to tell parents what the username and password was, it would be possible for students, to lock their parents out. I would argue much of the information you are worried about already exists in the public. – Ramhound May 30 '12 at 12:48
1  
@Ramhound in that case, the school should create a new password or even better a reset token. – Hendrik Brummermann♦ May 30 '12 at 15:59
show 1 more comment
up vote 2 down vote

Just some common sense security, never trust websites where they email you your chosen password (not a random generated one). Nobody should know your password, not even the website. If they know your password, it only means they store it in clear text. A secure website, will by far know and store a hash of your password, in order to be able to verify it. When you log in, the website can compute another hash based on your input and compare the two hashes. If they match, the password is correct, if not, it's not.

share|improve this answer
1  
Unless the site is sending you the email at the point of password creation - that by itself doesn't imply that the site is storing the password unhashed. That's not the OP's scenario, of course - she's talking about emails months later. – Michael Petrotta May 28 '12 at 20:16
Only if they're mailing you a password later when you've forgotten it. If it's on password change, the email's been generated before the password hash has been saved. Bad practice I agree, but our first attempt at shutting off the email password on change which was the default setting on a certain e-commerce software resulted in much yelling and swearing from customers and required an education campaign to tell them why it was a bad idea so they'd accept the fact they had to remember what they changed it to themselves as they wouldn't get it in an email. – Fiasco Labs May 28 '12 at 20:24
@MichaelPetrotta I said that if the password was not chosen by you, meaning that yes it's ok if the site is sending you an initial random generated password, for example when you created your account... My answer here is just to complete the things that have already been said and trying to give constructive advice. – Silviu May 28 '12 at 20:30
@FiascoLabs I totally understand. Maybe a better approach to this would be, every time someone has forgotten his/her password, you would just reset it, sending another random generated password which the user will be able to change later on... – Silviu May 28 '12 at 20:31
Thanks for the information. Interestingly enough, I am not forgetting my password. They are proactively sending it to me when they require me to get into the site to get something administratively done, such as class registration. Further, they are sending both my userid AND my password in the same USPS mail. I went in to change my password and they sent me a confirmation in email, again Userid and password. This is the same site I use to to check my kid's grades too, so I am in there enough to both remember my password, but certainly my ID. – CathyS May 28 '12 at 21:46
up vote 0 down vote

Sending the username and password in cleartext email is a poor practice, but I don't know if it is illegal or not.

To determine whether it might violate any law or regulation, you might look into FERPA. Educational institutions are subject to special compliance requirements under FERPA. FERPA tends to apply to educational institutions that receive funding from the US government. FERPA imposes strict regulations on access to student records, so your school's practices might trigger FERPA compliance issues that you could raise with the school. You've have to investigate the specifics of whether FERPA applies to this situation yourself, though.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.