At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website.
I'm by no means a security expert or expert programmer but I could tell (simply by trying) that I could continue to try incorrect passwords without being locked out. (brute force: viable)
After logging in I was forced to select 3 pre-determined security questions in the case of a password reset (out of a total of 8!) such as my first car's licence plate (never owned a car 3/7), my spouse's 2nd name (don't have a spouse 3/6), 2nd name of my first kid (don't have kids 3/5), birthdate, name of my highschool, favorite pet, favorite film or favorite piece of music.
Most these things you can simply get from my facebook, (which, I should note, has not been updated for years!) again showing a distinct lack of understanding in basic security practices.
I also get the feeling, from looking at the site through the developer tools they use incredibly outdated software
* Digest Algorithm, as defined in RFC 1321.
* Version 2.1 Copyright (C) Paul Johnston 1999 - 2002.
I reported this through my company but my superiors don't appear all that interested.
How would I go about:
A. Finding out if this site is really as insecure as I think it is?
B. if true: communicating this in an appropriate manner to the company itself (preferably in an anonymous fashion)