28

My son's school uses a 3rd party to handle tuition and fee payments. I have recently come to the realization that they completely fail in the area of password security.

  • Last month they sent a statement to my home. Included with the statement was a letter that had my username and password.
    • OH NOES! They don't encrypt their passwords!
  • Had some trouble logging in, so I clicked the 'Forgot my password' link. They emailed my username and password to me.
    • YIKES! They just send it through email unencrypted like that?
  • Logged in and went to change my password. After I submitted my new password, the next screen displayed my username and new password on the screen.
    • YOWZER!!! Don't they know there's a reason the password field shows those little dots instead of the letters the user types?

Given that the company has personal information (credit card numbers, bank account numbers, etc.), this is incredibly troubling. If they got this wrong, what else have they gotten wrong? I bet there's a SQL injection vulnerability in there just waiting to be exploited.

Now I'd like some advice as to what to do. I've sent an email to the offending company, explaining what they're doing wrong in terms of password security.

I am going to bring it up with the school, but I'm afraid that any discussion about the importance of password security will be met with confused looks and blank stares. But if I can say to them "This company is violating regulation X for the protection of consumer financial information," then they might understand what I'm trying to say.

Are there laws/regulations protecting people from these sorts of negligent security practices? Especially with companies that handle consumer financial information.

If they don't respond and improve their security, is there a monitoring agency I can report them to?

Any other recommendations on what I can or should do?

Edit:

I, the 3rd party and the school are all located in the US.

This 3rd party is a company that offers a 'tuition management' service, which (according to their web site) is used by over 2000 schools. Instead of submitting payments to the school, we submit our payments to this company. They take care of the depositing, accounting and collections for the school. For parents, you can review your bill and submit payments online, in addition to just mailing them a check.

I'm hoping that the school itself isn't liable for anything, since the failing is entirely with this other company.

Edit #2:

Thanks to all for the suggestions.

The school has a contract with the company which prohibits the school from accepting payments directly. I paid the 2011-2012 tuition before the contract went into effect, so I was able to pay by check to the school.

The school requires everyone to have an account with the 3rd party. Fortunately for me, the only personal information of mine the company has is my name and mailing address, and what used to be a really good password :-(

At this point there's no freaking way I'll pay by credit card or bank draft through this company. Paying by check is an option, but it's unclear if my check next year can be made out to the school, or if has to go through the 3rd party.

Improve this question
4
  • 3
    It may be worth noting that they may not actually be storing your password in cleartext - it may just be using some form of reversible encryption. (Almost, but not quite, as bad.) Of course, when you send it in the clear like that, any storage protections are effectively nullified anyway.
    – Iszi
    Nov 14, 2011 at 20:41
  • 3
    Change your son's name : xkcd.com/327 :)
    – user18116
    Jan 2, 2013 at 12:50
  • 4
    Name and shame the guilty: plaintextoffenders.com
    – Dan Is Fiddling By Firelight
    Feb 5, 2013 at 14:20
  • 2
    If you must pay through this company, at least create special banking/credit accounts that are just for the company.
    – Wayne Werner
    Dec 22, 2015 at 19:08

4 Answers 4

Reset to default
17

You don't list where you're from, so these answers assume you live in the US.

Credit-card processors are required to respect something called PCI-DSS (Payment Card Industry Data Security Standards). It lays out how data is supposed to be handled and stored, and (some really big) penalties for failure. Larger companies (like retail chains) get audited - smaller groups may get exemptions. Key to the discussions here is that all credit card numbers (and some additional information), as well as passwords for (at minimum) system admins, are to be kept encrypted as much as possible (especially in storage).

However, the school could be handling your credit-card securely, while handling the rest of the security poorly. Please consider:

  • Are you able to see your full credit-card number? If so, I'd be alarmed, although the company may need some way to reverse the decryption for handling things like reversals.
  • Besides paying your child's tuition, what else can be done on this site? It's unlikely that you are able to buy something on Ebay from there, so an insecure password may be a non-issue (just use a different password).

So, they may have security problems, or it could be deliberately relaxed to allow for a 'friendlier' system. Given the system's behaviour, you do have a legitamete cause for asking them about it. If their responses indicate inadequate/non-existant security, you should ask for an accounting, at minimum by having them take the website offline, and reporting them if necessary (keep in mind that this will increase tuition costs if fines are levied).

EDIT:

If the school is not directly handling the credit-card number, or indeed any of the related payment information, they are not liable for PCI violations (that I am aware of). This is one of many reasons so many websites offload payments to services like Paypal - they are no longer liable (compliance is HARD). I would argue that they do have an obligation to select a secure, reliable processor, but I don't know that I'd ever sue them for that - it's the payment company's responsibility to act appropriately (that's the service they are providing).

Storing end-user passwords in plain-text is disturbing, but this may still be a non-issue. Send them an email/letter referencing this fact (especially the fact that they mailed you a letter with the plain-text password), and ask what's up. Again, if your payment information is not (completely) visible to you, it may still be handled securely (if it's displayed, report them). Otherwise, given the (probably extremely) restricted financial domain, there isn't likely much an attacker could do with the information - paying for their own tuition would be something of a dead giveaway, if it's even possible.

If you're still concerned, remove all of your own information, pay by check, and notify your school about your concerns.

Improve this answer
6
  • The offending company offers a tuition management service, used by over 2000 schools. It's new to our school this year, so the school could just fire the company and go back to handling tuition directly again, or find a replacement. I'll clarify.
    – leedm777
    Nov 14, 2011 at 18:25
  • 3
    Thanks for the additional info! PCI section 8.4 reads "Render all passwords unreadable during transmission and storage on all system components using strong cryptography". Wouldn't sending by snail-mail and e-mail violate that section?
    – leedm777
    Nov 14, 2011 at 20:07
  • ... Maybe... It depends on whether the passwords referenced are the ones most required as part of 8.2, and whether those 'users' referenced applies to regular consumers (like you), or whether it refers to 'system admin' users (possible, given some of the rest of the listing). Regardless, it's a terrible faux-pas, if nothing else.
    – Clockwork-Muse
    Nov 14, 2011 at 21:01
  • 1
    There is a certain expectation that the reader of an email is the owner of the account. While sending the password is plaintext its not the most serious security threat..You didn't mention if they challenged you BEFORE sending the email. If you had to supply blood from your first born, it would be reasonable to say that, you have access to your email account. I of course would just write checks to the school directly. This gives you additional benefits.
    – Ramhound
    Nov 14, 2011 at 21:06
  • @Ramhound Good point. Before sending the password, they required my user id and 'Family ID'; a hideously long number that I think serves as an account number.
    – leedm777
    Nov 14, 2011 at 21:26
9

First, never use your debit card on that site. Only use a credit card, if you absolutely have to use that site. With credit cards, you're protected against fraudulent transactions, and often have no, or very little ($50), liability. With debit cards, you may get your money back eventually, but you're still out of pocket until you do...

Do not provide any data to that site that is not absolutely required. Take any bank details off that site. A site that insecure, you're asking for real trouble if someone gets a hold of your username/password (which seems plausible), and then they have your name, address, CC info, bank info, etc.

If the website is storing your CCV number post-authorization, then that's a violation. If they're just storing the number, and your other information, they may be within the boundaries of PCI compliance.

Have a good read of requirement #3 of the PCI standard, to see if you notice any violations of that. However, PCI really is about card and cardholder data, and handling/retention of that data, and I don't think has any requirements related to website passwords.

@X-Zero already mentioned PCI compliance, here are URLS and Email Addresses for each of the major brands that you could email to ask their opinion of a site that does this also hosting credit card numbers. There's a good chance that if your password is not encrypted then neither are any of the other information on the site.

American Express

Discover

JCB

MasterCard

Visa United States

Visa also maintains a list of PCI compliant payment processors, so you could encourage the school to pick a vendor off that list, if the handler isn't already on it.

If you are still uncomfortable dealing with this processor, you could start writing check's, or use your bank's bill pay service to cut checks, to the school if that's the kind of payment processor they are going to use, and make clear to the school that you're not OK with their choice of provider, and that you feel extremely uncomfortable with that organization's handling of what should be confidential information.

Unfortunately there are a lot of people involved in areas of information handling where they really don't have the expertise to do it properly, and in some cases are not even aware that there are guidelines and best-practices to follow, but they know someone who knows someone, and they got a credit card processing machine, set up a website, and ended up with a contract to process payments for a school.

It's a scary world out there if you spend too much time thinking about it.

Improve this answer
6

Practically speaking: walk away. I'm assuming that you aren't somehow forced to use this company -- you can mail a check instead of using the tuition processing company's website.

The reason I say just walk away is because poor password handling procedures is probably just a symptom of deeper security cluelessness. (If they can't get passwords right, how much are you willing to bet there isn't an SQL injection vulnerability that would allow someone to gain access to the entire database, including card numbers and personal details? It's not a hypothetical question: your money's on the line.)

Before you cancel your account:

  • Delete your credit card details, or edit them to something bogus.
  • Scramble your personal information: edit your address, phone number, email, to something bogus.

If you're willing to go through some (possibly a lot) extra effort, explain to school officials that you've canceled your account, tell them why, and offer to help them select another provider when the contract with the current provider expires.

Improve this answer
6
  • 1
    Completely walking away is not an option, sadly. The school's contract with the company prohibits the school from taking payments directly. While the school requires an account w/ the company, I can pay by check. I'll add more details to the question.
    – leedm777
    Nov 14, 2011 at 22:33
  • 1
    @dave: Paying by check may actually decrease the protection you get. AFAIK, a lost credit card number has better liability protection than a lost checking account number.
    – bstpierre
    Nov 14, 2011 at 22:43
  • 2
    @bstpierre is right. a check has on it the routing and account number, which is all someone needs to steal your money.
    – Tim Kennedy
    Nov 15, 2011 at 1:11
  • @bstpierre You have sufficiently scared me from conducting all business. I shall now put all my money in my mattress, and hide under it.
    – leedm777
    Nov 15, 2011 at 14:37
  • 1
    @dave: There are liability protections from the misuse of your checking account number. It's harder to get money out of your insurance company when someone steals a bunch of cash from your mattress. Not to mention that theft of an account number is remote; theft of mattress money is up close and personal. I'd rather have my number stolen by someone mysterious and far away. You can't avoid all risks, you can only shift them.
    – bstpierre
    Nov 15, 2011 at 15:04
2

I love X-Zero's answer. It all comes down to - what data is protected by the system using passwords badly, vs some other party's system. There are laws protecting credit card information - as X-Zero mentioned. There are also varying laws in different states protecting "personal information" - such as your address, birthdate and other personal details. It gets complicated as the company providing the service may not be located in the same state as yourself and the school - and the variations in legal coverage in terms of the location of the service (the company's servers) vs. the location of the violation (your home, the mail, etc), can make enforcement all kinds of challenging. So - in the practical sense - yes, there are laws, but unless you are interested investing quite a lot of money into this effort, it is unlikely that you will get easy, cheap protection from these laws.

Fallbacks in a more practical sense:

  • the extreme - survey other school tuition systems and move a school that takes your privacy more seriously. Seems extreme to me, but it's likely to be the most forceful way to drive home the point.

  • less extreme - insist on paper billing or any other mechanism that involves not keeping an account online.

  • less extreme - complain to both the school and the company. With the company, explain in detail and reference laws that you believe are being violated. With the school, dumb down the problem and recommend alternatives. It's been my experience that educational systems are hurting for smart tech people, and you can have things your way if you volunteer to help and take ownership of the problem.

  • focus on protection - establish a credit card with a low limit that you can use purely for this. There are such things as "temporary" numbers and other protections offered by credit card companies that limit the damage of card number exploitation. If you can't fix the system, limit the damage.

  • keep your data in good shape - regularly review bills on exposed credit cards, check your credit report, etc. General good consumer health checkup type stuff that benefit you regardless of the weakness of the security of the systems you are using.

Improve this answer
2
  • Damage control is a good idea, but a card with a low limit doesn't really matter. You're only liable for $50 -- though if you have a card that limits the liability to $0, go for that. Using a separate card is a good idea, especially if you have a card that doesn't get used for much -- you (or the issuer) will notice unauthorized use faster. Paper billing might not matter if the service has other security problems (see my answer -- password mishandling is a symptom, not necessarily "the problem").
    – bstpierre
    Nov 14, 2011 at 22:48
  • @bstpierre I'm sure I agree about the less frequently used card. You're more likely to notice a fraudster trying to skim off a few dollars a month without noticing on a seldom used card. At the same time if they max your card out buying big ticket items; a card you use daily suddenly being denied will result in the fraud being detected almost immediately vs potentially only a few weeks later when you get your next statement.
    – Dan Is Fiddling By Firelight
    Feb 5, 2013 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .