I'm facing a situation with an online site I must (for the immediate time being) use for financial and HR-related matters that just sucks. In every sense, but security in particular. As much as I'd like to, I can't ditch this site immediately, but am definitely moving towards doing so ASAP (within a few months at the outside, I hope). It is a very large portal in the US for accessing highly sensitive information over web - HR, financials, accounting and the like.
Their security Sucks. A screenshot below, and note that the password is limit to 12 characters long.
12 character password, no special character set, and subverted by security[-eliminating] questions that are mostly answerable with a few public records searches and/or some decent Google-Fu. No checks to make sure the PC accessing it isn't infected with something nasty or anything like that, either, naturally.
Again, this is a very large, US-based portal for HR and financial information. If I wasn't so used to appalling security on the web, I'd be really pissed off, instead of just moderately angry and concerned. So far as I can tell, there is also no alternate authentication method, such as two-factor auth, the ability to disable the security questions, or use a password that might actually hold out for more than a few minutes against an attacker who knows what he's doing.
I don't have visibility into their behind-the-scenes security (password hashing, salting, penetration testing, vulnerabilities, etc.), but based on what I've seen so far, I bet that pulling back the curtain would only be more cause for concern/alarm.
- What can I do to best secure myself while I have to tolerate this abomination?
- What should I do regarding the fact that all this sensitive information for so many people is being guarded by such poor security polices? How should I notify, and what do I do when I get the canned
we take security seriously, eff offresponse I know I'll get?
- As theorized, pulling back the curtain would probably reveal some true horrors, but that seems like a bad idea.
I'm going to apply an answer to what I've done thus far to handle this from the standpoint of my personal security, but I'm not sure if I've done enough or missed anything I could be doing (given that I have to use this PoS) and would welcome your feedback.
I have no idea what to do regarding (2). My experience has been testing my own systems and fixing them, not stumbling across systems like this with worse security than my phone, backed by a massive corporation that will move slower than molasses uphill in winter (unless I do something stupid/out of line and they decide to sue me, in which case I bet they'll move really quick).