1

Most people have personal information on many sites such as Amazon or smaller sites. When we type create an account and add details like our address and the place where we work, it is never said how well this information will be stored and secured. Then how do we know we can trust a site to be secure ? What if everything was stored as plain text or what if they were to sell this information ? Is there a way to verify this without being a security expert ? Thanks.

  • 1
    Well, if you ask to change your password, and you receive an email with your current password in plain-text, that's one dead giveaway you shouldn't trust this site. – Damien Jul 6 '16 at 11:30
  • Sure but if they don't give it at all, it's not a proof that my password is safe though. – Shashimee Jul 6 '16 at 13:20
  • 1
    Yes, it's easier to untrust a company than to trust a company. Something big like password stored in plain-text is a big 'No-no' but you will never be able to trust websites 100%. – Damien Jul 6 '16 at 13:24
  • @Shashimee the best way to protect yourself is inquire (and if available, use) two-factor authentication. It's also good practice to use unique passwords for each service / account you have to eliminate password re-use attacks. – DKNUCKLES Jul 6 '16 at 13:25
  • xkcd: Password Reuse – a CVn Jul 6 '16 at 14:30
2

Any time you provide information to any service provider there is an inherent level of trust involved. The best way to get the information you're looking for is by asking for it, but you have to hope and trust that they're telling you the truth and that security is actively addressed and measures are maintained.

  • Ask the service provider for information on their security practices, data storage and retention policies, data centre locations etc. They can appropriately answer these questions without sacrificing operational security and refusal to answer these questions should leave you wary.
  • Depending on the information they maintain and their jurisdiction there are frameworks and laws that need to be adhered to so ask about their compliance. These will vary but some notable ones are PCI DSS for those who handle credit card data and HIPAA (US) for health information and FIPPA (Canada).
  • You can inquire as to how passwords are protected if you're so inclined. We'd like to think that everyone hashes their password with a strong algorithm but even large companies have hashed with no salt or weak algorithms.
  • Inquire about their data sharing policies - who are they planning on sharing your data with? Ask them if they've done their due diligence in vetting their partners security. Many cyber security policies require the policy holder to vet and provide information to the insurer in regards to their partners security practices.

Now with that said it's not uncommon for organizations to think that they're secure but to completely overlook that dev box they stood up for testing a year ago that contained live data that wasn't included in the scope of security. Again we go back to that concept of trust but there is no real effective way to mitigate the risk of your personal information being compromised. Reduce your potential attack vector by being selective in who you provide your information to and you'll reduce the likelihood that your info will end up in the hands of people you don't want it to.

3

it is never said how well this information will be stored and secured

It's untrue that you are not told about data protection promises from the provider (see privacy policy). Also, use/reuse of data is described (often in a fuzzy way) in the Terms & Conditions that we approve so quickly. Technical implementation of the security/storage systems (including encryption used) are rarely shared with end users, however most companies are cautious about making promises.

Ensure that the company that you trust has been through independent audits and has been certified to meet compliance standards. Depending upon the location, regulatory bodies have been known to act against deceptive practices.

Some studies do show that Data Protection guarantees are hard to enforce [EU] [US].

As an individual you have very little power for individual verification for most websites. The Australian Government has a simple 8 point list of what to look for before you trust an entity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.