I am following an online class from a local institution. Recently, I've noticed they don't hash passwords because they sent me my password by e-mail in clear text.

The website has a lot of personal information so I've decided to test how secure it is.

After a few minutes of testing the private message system, I've found out that you can view, delete, reply to any message with any username. Also, they sent a message to everyone with their password recently so I can see everyone's password. XSS attacks are possible as well.

I've reported the vulnerabilities and it still hasn't been patched (it's only been a week but if I were responsible of a system like this, I wouldn't sleep until everything's fixed).

How can I make them secure their website properly? My own personal information is also at risk here.

(To make sure there are no more answers related to that, I am well-aware of the laws. It doesn't change the fact that some day, someone will do exactly what I did but with bad intentions.)

  • 3
    About the only thing you can do is make it very clear to them (and to more than one contact at the company if possible) just how serious this is. If you can get an e-mail contact of someone in charge, and not just [email protected], then try to make upper management aware of the problem. Give them time to fix it. It may take more than a few weeks to do this as it may be a lot more complicated than you might imagine. Jun 3, 2013 at 15:20
  • 3
    You don't. nbcnews.com/id/51983204/ns/…
    – Travis
    Jun 3, 2013 at 15:22
  • 5
    Please realise that while your intent is noble that "testing" the security of a website without prior approval of its owner is in most countries considered illegal and may result in prosecution. Jun 3, 2013 at 15:25
  • 1
    Others have discovered this is dangerous territory - techdirt.com/articles/20111015/20563516374/…
    – zedman9991
    Jun 3, 2013 at 17:36
  • 2
    Give them a demo of what is going to happen with their site in future anonymously?
    – user32902
    Dec 18, 2013 at 11:00

2 Answers 2


So there's a couple of options open to you potentially, depending on the country you live in, however first a note of caution.

You "tested" the site and then reported your findings. In many countrys if the application owners want to make out that you "hacked" them, they could do that, and it may be bad for you. I say this just so you can weigh it up when you're considering taking other actions. I'll leave aside any more legal stuff on hacking as it's been covered in other answers.

Basically the main ways to get them to address this would either reporting this to a regulator/government body who are responsible for data protection (e.g. in the UK, the information commissioner), as it seems that they're not taking appropriate measures to protect personal data which they are processing. This may get them to fix it if the regulator contacts them regarding the problem.

The other option would be to try and attract bad publicity to the site, by publishing the details of the vuln. This may have the desired affect, but be aware a likely side affect is that they could take legal action against you (again depending on the jurisdiction, they're attitude to security etc)

  • 1
    This is the kind of answer I'm looking for. Reporting this to a government sounds like a great idea. It will take some research but most-likely what I'll end up doing. Publishing the vulnerabilities definitely would get it fixed but I don't feel like doing this because it will penalize users who are only trying to complete some classes for their education degree. Thank you.
    – Simon
    Jun 3, 2013 at 16:14

"so I've decided to test how its security is." And there was the point where you crossed the line. Unless you have explicit permission to "test" security, you are breaking the law.

"Exceeds Authorization The term "exceeds authorized access" is defined by the CFAA to mean "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6)." https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_%28CFAA%29

Now onto your other comment: "My own personal information is also at risk here." Ask to have your data removed as you do not wish to be on an insecure system. However, as I stated initially, unless you have explicit permission to test their site, I'd stay far away from doing so.

I am going to edit my comment. While I posted information on US Laws, this is because I am from the US. I have seen no other countries where testing without permission is not legal. To answer your edit Simon: "It doesn't change the fact that some day, someone will do exactly what I did but with bad intentions" This is completely irrelevant. Why break any laws to prove a point. If you're that opposed to having your information stored on that server, have them remove it.

While your initial thought would be that you are "helping" those with information posted by exposing the risk (you just as well may be), there have been instances where exposing "flaws" have led to jail time. You can contact whomever is responsible for their server, if that doesn't work, you can start CC'ing others in the same company/institution, maybe that would help. If you're in the US, you can try getting this addressed via CERT. If in another country, you can trying finding that country's CERT.

  • 2
    I'm sorry but there is no indication that this person lives in the U.S. Jun 3, 2013 at 15:28
  • 1
    You're correct, however there is no known place that I can think of, where it is legal to perform arbitrary security tests. Since I am in the US, its easier to reference local laws
    – munkeyoto
    Jun 3, 2013 at 15:31
  • 2
    True but it is preferred to make your answers as applicable as possible if you could just add something like your comment to your answer it would benefit your answer and I'd give you an upvote Jun 3, 2013 at 15:47
  • 1
    @simon that doesn't make it any more legal Jun 3, 2013 at 15:50
  • 2
    @LucasKauffman You are absolutely right but let's see it the other way around; it doesn't make the website secure because it's not legal to test if it has vulnerabilities.
    – Simon
    Jun 3, 2013 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .