2

Whilst on the phone to support staff (about billing) to Virgin Media, perhaps the largest ISP and telecoms company in the UK, I was asked to confirm my password over the phone.

I asked the advisor if they could see my password in plain text, and they said they can!

I am currently wondering what the best course of action is for me to bring this issue to the attention of Virgin Media's management. The fact that any call center worker could go home and access my Facebook account is bad enough, but if the passwords are stored in plaintext, Virgin Media is sitting on an information security timebomb and all their customers are at risk.

How do I get Virgin Media to handle passwords securely?

3

Generally, reuse of passwords across different sites is a bad idea for this reason; you never know whether they are taking measures to secure your password from view of staff or hackers who might grab the database. Of course, once one of these sites is compromised, hackers will try the same password combination for other common accounts like Facebook, PayPal, etc etc.

I recommend using LastPass, KeePass or another password manager to generate a new, random password for every site you login to and then save it. Sure, having all your eggs in the LastPass basket might seem like a security risk, but at least they are more trustworthy to use best practices and secure your data. This is evidenced by the recent hack of LastPass, which because they had been salting/hashing their passwords so well, I haven't bothered to change my master password because the risk of compromise is so small.

I think using random passwords and saving them in a manager like LastPass is a MUCH better practice than memorizing and reusing passwords on different sites. It also has the advantage of being easier/quicker to login as well, and reduces risk when you create logins on sites that you don't trust.

| improve this answer | |
  • You forgot the requirement to refresh your passwords on a schedule. Just setting-and-forgetting passwords will compromise your password management plan. – schroeder Jun 24 '15 at 23:50
  • I'm not sure if I consider that a requirement. Sure, your master password should be cycled eventually, and two-factor authentication should be enabled if applicable. However, I wouldn't go and cycle my random forum or other un important website passwords regularly if they are random and aren't reused. What would the advantage be of cycling such single use passwords? – Herringbone Cat Jun 25 '15 at 0:04
  • 1
    You must assess your risks for each asset (I don't cycle all my passwords), but you seem to suggest that with MFA and good practices on the vendor side that you won't change your passwords at all, even after a known disclosure event. Cycling your passwords still needs to be a part of password management. – schroeder Jun 25 '15 at 0:16
  • I actually think changing important passwords that cannot be recovered (like a LastPass master password) may be a greater risk for some users than not changing one after a disclosure event where only encrypted data, salted hashes etc are leaked. Memory is a fickle thing. Of course as you indicate, risk must be weighed ad hoc and I'm only talking about my subjective opinion of this specific instance of the recent LastPass breach. Writing down a master password on a post-it or forgetting the password however is a major risk to also consider. – Herringbone Cat Jun 25 '15 at 0:25
  • Just to clarify: I don't even have a Facebook account, and I know about password security. I used that example to draw attention to the particular issue; that fact that a major ISP doesn't encrypt passwords – glcheetham Jun 25 '15 at 8:50
-1

Never use the same password for multiple sites. Never. It is as simple as that. IMHO, the best solution would be to use some kind of password manager. Create master password for the password vault and generate all your passwords for all sites randomly. This solution really works and using this system, you can forget about your password worries for good.

| improve this answer | |
  • 2
    How does this differ from my answer? :) – Herringbone Cat Jun 24 '15 at 22:09
  • You forgot the requirement to refresh your passwords on a schedule. Just setting-and-forgetting passwords will compromise your password management plan. – schroeder Jun 24 '15 at 23:50
  • Yes, refreshing your important passwords is important. The importance depends on how important is data that are protected with password. The more important is the password, the more often and more carefully one should change/manage it. – Acetylator Jun 24 '15 at 23:57
  • Just to clarify: I don't even have a Facebook account, and I know about password security. I used that example to draw attention to the particular issue; that fact that a major ISP doesn't encrypt passwords – glcheetham Jun 25 '15 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.