My son's school uses a 3rd party to handle tuition and fee payments. I have recently come to the realization that they completely fail in the area of password security.
- Last month they sent a statement to my home. Included with the statement was a letter that had my username and password.
- OH NOES! They don't encrypt their passwords!
- Had some trouble logging in, so I clicked the 'Forgot my password' link. They emailed my username and password to me.
- YIKES! They just send it through email unencrypted like that?
- Logged in and went to change my password. After I submitted my new password, the next screen displayed my username and new password on the screen.
- YOWZER!!! Don't they know there's a reason the password field shows those little dots instead of the letters the user types?
Given that the company has personal information (credit card numbers, bank account numbers, etc.), this is incredibly troubling. If they got this wrong, what else have they gotten wrong? I bet there's a SQL injection vulnerability in there just waiting to be exploited.
Now I'd like some advice as to what to do. I've sent an email to the offending company, explaining what they're doing wrong in terms of password security.
I am going to bring it up with the school, but I'm afraid that any discussion about the importance of password security will be met with confused looks and blank stares. But if I can say to them "This company is violating regulation X for the protection of consumer financial information," then they might understand what I'm trying to say.
Are there laws/regulations protecting people from these sorts of negligent security practices? Especially with companies that handle consumer financial information.
If they don't respond and improve their security, is there a monitoring agency I can report them to?
Any other recommendations on what I can or should do?
I, the 3rd party and the school are all located in the US.
This 3rd party is a company that offers a 'tuition management' service, which (according to their web site) is used by over 2000 schools. Instead of submitting payments to the school, we submit our payments to this company. They take care of the depositing, accounting and collections for the school. For parents, you can review your bill and submit payments online, in addition to just mailing them a check.
I'm hoping that the school itself isn't liable for anything, since the failing is entirely with this other company.
Thanks to all for the suggestions.
The school has a contract with the company which prohibits the school from accepting payments directly. I paid the 2011-2012 tuition before the contract went into effect, so I was able to pay by check to the school.
The school requires everyone to have an account with the 3rd party. Fortunately for me, the only personal information of mine the company has is my name and mailing address, and what used to be a really good password :-(
At this point there's no freaking way I'll pay by credit card or bank draft through this company. Paying by check is an option, but it's unclear if my check next year can be made out to the school, or if has to go through the 3rd party.