Re:Starbucks caught storing mobile passwords in clear text
by ctdonath on Thursday January 16, 2014 @10:32AM
(#7069883)
"Adding money" means applying a credit card to purchase Starbucks credit, usually by a sequence like "Reload card -> $25 -> Confirm" on a pre-stored credit card number. Buying from the app has a small cash pool to draw from; reloading from a CC can get one a whole lot more money.
[ Parent
| on HN ]
Re:Starbucks caught storing mobile passwords in clear text
by jessaustin on Thursday January 16, 2014 @11:02AM
(#7070086)
I'm not a Starbucks regular so I may have missed a detail. Transferring money from a stored bank account to the app seems to be a server action, so the server should be doing the auth. What then is the point of storing the password on the client? If it's just to confirm possession of the phone, a token would be better for usability, as well as in all the other ways a token is superior to a password. TFA says the password is also used to activate the app, but a token signed with a timestamp and emailed to the user would be better for that.