Starbucks caught storing mobile passwords in clear text

Re:Starbucks caught storing mobile passwords in clear text by nly on Thursday January 16, 2014 @10:09AM (#7069725)

Every single app on your phone that remembers a username and password combination, or any other credential, is likely vulnerable.

Imho its about time that Google required the presence of a HSM in Android devices for key storage. A HSM that locked me out after ~10 x 6 digit PIN guesses (with software locking me out at a lower number) strikes me as a good thing. If someone wants to destroy my $500 phone, prise out a chip, grind it down, and look at it under an electron microscope to extract my passwords, then good luck to them. Why isn't this happening?

[ Parent | on HN ]

Re:Starbucks caught storing mobile passwords in clear text by jessaustin on Thursday January 16, 2014 @10:50AM (#7070015)

A HSM that locked me out after ~10 x 6 digit PIN guesses...

And now you've got a DOS enforced by hardware. Hopefully if I bring it back to the store I can get it reset? The existence of this reset sort of negates the point of an HSM.

However, I could see the point of an Android module that, rather than locking the user out, would simply delete keys the password to which had been entered incorrectly a configurable number of times. For an app like this, the user would simply have to enter a password and CC again.

[ Parent | on HN ]

Re:Starbucks caught storing mobile passwords in clear text by nly on Thursday January 16, 2014 @11:12AM (#7070158)

Yes, a reset/unlock is a bad idea. Keys should be erased, and it should be up to apps/services to determine an appropriate means to re-authenticate users.

[ Parent | on HN ]