I'm employed as a consultant at a big tech consultancy. I recently noticed a major flaw in their website, they send my login credentials in plain text over HTTP. I verified this by doing a outbound packet capture and lo and behold there were my credentials plain in view for anyone to see. What's worse the credentials were sent back over the wire once again in plain text if the login failed.
On the upside, they're not affected by heart bleed because they don't even allow HTTPS traffic...
I have read Reporting vulnerable sites and similar but I believe this question is a bit different as first of all I'm personally affected and forced to use the site regularly as I'm employed by the company owning the site (albeit not responsible).
I have informed the IT department and got a response in the form
We have prior to your e-mail contracted a security firm that has done an extensive pen-test and among other things found your reported vulnerability. We're assessing the situation and will take action shortly.
Which to me means:
Hi we know we're leaking your passwords and we might patch it up in the coming months or maybe next year. Meanwhile, why don't you go down to the church and pray that no one empties your paypal account.
Motivated by the fact that I could just park my cellphone on wifi outside their office with wireshark running to grab the credentials of most people in the office. To me, their response is not good enough. Further more, all they need to do is to force HTTPS for all traffic as a stop-gap. This doesn't take more than a few hours for a system administrator who knows what they're doing. And it doesn't have a negative impact other than some performance (provided they have patched OpenSSL if they're affected).
My question is, how do I get them to first enable HTTPS for all traffic immediately and then inform all affected parties that their username/password credentials may have been compromised and that they need to change them at all places they use that combination. Without loosing my job.
For the record, yes, I have changed my passwords already. And I had a random 128bit password to their site to begin with because I got a feeling it was dodgy from first sight.