Timeline for What to do if stuck with website that has poor security?
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 4, 2018 at 19:40 | comment | added | DasBeasto | Re update: They finally migrated to a completely new site. Although the new site is awful and broken it does not have the same issue. | |
| Jan 10, 2017 at 14:12 | comment | added | DasBeasto | For anyone wondering, nearly a year later and no responses to any of my emails, in-website complaints, or complaints to the FTC. And the same issue is still present on the website. | |
| Mar 20, 2016 at 1:26 | answer | added | Ben Voigt | timeline score: 2 | |
| S Mar 18, 2016 at 18:26 | history | mod moved comments to chat | |||
| S Mar 18, 2016 at 18:26 | comment | added | Rory Alsop♦ | Comments are not for extended discussion; this conversation has been moved to chat. | |
| Mar 18, 2016 at 18:07 | answer | added | Alex KeySmith | timeline score: 7 | |
| Mar 16, 2016 at 21:08 | answer | added | Emmet | timeline score: 120 | |
| Mar 16, 2016 at 18:38 | answer | added | Neil McGuigan | timeline score: 3 | |
| Mar 16, 2016 at 18:12 | vote | accept | DasBeasto | ||
| Mar 16, 2016 at 15:16 | comment | added | Dan Is Fiddling By Firelight | They could be storing the password encrypted instead of in plaintext; which is marginally less bad. It avoids a trivial plaintext leak from just a DB dump or SQL injection. It's still not good practice because if the server's compromised the attacker will probably be able to extract the decryption key with a bit of extra work. | |
| Mar 16, 2016 at 15:05 | history | tweeted | twitter.com/StackSecurity/status/710119865240133632 | ||
| Mar 16, 2016 at 14:01 | answer | added | Tobi Nary | timeline score: 91 | |
| Mar 16, 2016 at 13:57 | comment | added | void_in | Use a unique password for this site. Also, I am not sure if they are using HTTPS but considering the other security loopholes they have, I won't be surprised if SSL is missing as well. In that case make sure to always access the site from a relatively trusted network where no sniffers are installed. Granted that people who own the network or tap into the ISPs routers can still get all the info in plaintext over HTTP but this is the best you can do right now. | |
| Mar 16, 2016 at 13:49 | comment | added | xorist | Tell your company you're getting the loan from to get their act together. If the ship goes down and your information gets leaked, feel free to call the police for the stolen information and hire a lawyer for the method of which it was stolen.. (The site was insecure, so ultimately, it's the company's fault.) | |
| Mar 16, 2016 at 13:49 | comment | added | Tobi Nary | Public shaming might be a way to go. Ironically served http only;) | |
| Mar 16, 2016 at 13:44 | history | asked | DasBeasto | CC BY-SA 3.0 |