Re:Starbucks caught storing mobile passwords in clear text
by gamerdonkey on Thursday January 16, 2014 @11:33AM
(#7070348)
"... a datum ain't worth much to anyone other than the PI my wife hired to find out if I'm sleeping around or an attractive lab technician in CSI: Miami."
This is completely off-topic, but am I the only one who wondered why his wife would hire a PI to find out if he is an attractive lab technician?
Not as a critique, I just find grammatically-correct ambiguous cases like this one interesting.
Re:Starbucks caught storing mobile passwords in clear text
by annnnd on Thursday January 16, 2014 @10:05AM
(#7069703)
Exactly!
Also, is it safer having the password saved on your phone in cleartext, or is it safer if user has to enter it every time in front of strangers?
Re:Starbucks caught storing mobile passwords in clear text
by jessaustin on Thursday January 16, 2014 @11:08AM
(#7070127)
So are passwords broken or not? (Hint: they are.) You can't use the inherent drawbacks of passwords as an excuse for introducing even more vulns.
ISTM the location data is stored client-side not because of some wise decision to spread data out (and then what, include it as query data in future reqs to the server?) but rather because their error handling module wasn't configured.
Re:Starbucks caught storing mobile passwords in clear text
by brudgers on Thursday January 16, 2014 @11:24AM
(#7070260)
The greater vulnerability may be exposing all passwords to a single attack. The non-centralized redundant nature of the internet is a loose analogy. My server may go down, and it will suck for me, but it doesn't necessarily increase the risk to your server.
Compared to what? The implicit assumption is that Starbucks gathering and storing geolocation data is not a potential invasion of privacy or a meaningful risk. The person who steals my iPhone is very unlikely to do so for the data it contains. Their goal is to flip it for cash and a datum ain't worth much to anyone other than the PI my wife hired to find out if I'm sleeping around or an attractive lab technician in CSI: Miami.
No the real risk to privacy is when Starbucks' servers are comprised. Today's Willy Suttons are still bank robbers not pickpockets. Spreading the data out spreads the risk and reduces or eliminates the probability of a catastrophic breach.
Of course it will be popular sport to pillory Starbucks for not following the conventional wisdom because it allows us to ignore the fact that passwords are broken. There's no technical fix for poor password hygiene among iPhone owners and an encrypted password will barely slow down a determined attacker with a couple of GPU's and physical possession of the phone.