Hacker News Reader

Comment by scoot | Hacker News Reader

First, the level of technical incompetence is staggering:

* Two significant breaches in 7 months * Bank/CC and personal details stored unencrypted * Pssswords stored in cleartext * "We have taken all necessary measures to secure the website." That's what they said last time.

Second, the response is laughable:

* Two days since the breach was discovered, and customers still haven't been notified. * No mention of the breach on the talktalk.co.uk home page. * The site in question [1] says it is offline due to an attack, but doesn't like to the relevant help page [2]

[1] https://myaccount.talktalk.co.uk/ [2] http://help2.talktalk.co.uk/oct22incident

View on HN

The number of sites that have flaws like you mentioned (encrypted data and clear text passwords) is worrying.

Is there not a independent third part that can audit sites for this kind of incompetence and rank or award compliant sites so consumers can factor this in when choosing services?

Yes, PCI QSAs. All they can do, and all the ICO can do, is fine you. A typical fine might be £10k-£100k. For these large businesses, they see it as being more cost effective to be cavalier about security and pay off the authorities. See amazon's credit card handling, for instance.

Like most things in life, it's a two tier system.

There's this site which acts as a 'wall of shame' for blatant violations of storing passwords in plaintext - http://plaintextoffenders.com/

Not sure if it's actually effective at getting things done but certainly is a nice reminder for the consumer to be careful.

>> We have taken all necessary measures to secure the website

It is probably wrong to read too much into the wording. But it is jarring when a company of this size presents their website as if it is external to the rest of their operations.

Yes, it sounds hilarious to me, but I think it says more about the technical knowledge of the population they are trying to communicate with than TalkTalk's own technical knowledge.

This work doesn't provide a direct audit for websites but it does measure software security at organizations.

https://www.bsimm.com

"Password stored in cleartext" - wait, what?! Where have you seen a reference to that?

From the help page:

"TalkTalk will also NEVER

Send you emails asking you to provide your full password. We will only ever ask for two digits from it to protect your security."

AFAIK, you can't verify two randomly selected characters to a hashed password. My bank is also guilty of this.

Edit: direct evidence from TalkTalk: https://twitter.com/TalkTalkCare/status/514417284560191488?r...

You can achieve this by hashing all the possible combinations that you could ask for with a salt and store those.

Reply on news.ycombinator.com