Re:I don't want the notice of insecure password/log-in on my...
by wyldfire on Tuesday March 21, 2017 @01:52PM
(#13924512)
> Your notice of insecure password and/or log-in automatically appearing on the log-in for my website, Oil and Gas International, is not wanted and was put there without our permission
Just wait until he finds out that firefox is blitting pixels to the display buffer! Who invited them anyways?
Re:I don't want the notice of insecure password/log-in on my...
by grawlinson on Monday March 20, 2017 @10:14PM
(#13919315)
Quick question regarding this security pop-up. I don't have much experience with the security side of things apart from HTTPS certs/etc, but isn't Dell's NZ website a bit iffy?
i.e. dell.com/nz/ -> 'My Account' looks like it's done over plain HTTP. Is my assumption correct?
Re:I don't want the notice of insecure password/log-in on my...
by BinaryIdiot on Monday March 20, 2017 @08:00PM
(#13918706)
Also this reddit thread is interesting; looks like someone already dropped their user table. Which may have been for the best considering it appears that they stored passwords in plain text (then again I'm sure someone dumped it before dropping it).
Re:I don't want the notice of insecure password/log-in on my...
by aruggirello on Tuesday March 21, 2017 @11:20AM
(#13922947)
>> Your notice of insecure password and/or log-in automatically appearing on the log-in for my website, Oil and Gas International is not wanted and was put there without our permission. Please remove it immediately. We have our own security system and it has never been breached in more than 15 years. Your notice is causing concern by our subscribers and is detrimental to our business.
Oh my... HTTPS was already well established 15 years ago... are people like this in charge of nuclear facilities, too?
Re:I don't want the notice of insecure password/log-in on my...
by Nadya on Tuesday March 21, 2017 @02:02PM
(#13924600)
It's unfortunate the IT had to find out the hard way just how broken their site security was. It's worse that this isn't the only site out there that is that broken. It's common, they just happened to publicize their lack of knowledge of security and then users went poking around. "Oh hey, SQLi works." and that's that...
Here's hoping they manage to give proper disclosure to their customers/users (hah...doubtful).
Just wait until he finds out that firefox is blitting pixels to the display buffer! Who invited them anyways?
i.e. dell.com/nz/ -> 'My Account' looks like it's done over plain HTTP. Is my assumption correct?
https://www.reddit.com/r/programming/comments/60jc69/company...
Oh my... HTTPS was already well established 15 years ago... are people like this in charge of nuclear facilities, too?
Here's hoping they manage to give proper disclosure to their customers/users (hah...doubtful).