Another software fail: Trapster loses emails & passwords

I think it should be mandatory for any software/service that stores user data to have a security bootcamp before deploying their solutions teaching good robust design, how to approach writing secure code and have the necessary checks and balances to avoid vulnerabilities. It'll save them the heartburn and embarrassment to a good extent. Web Security is really under-rated by most developers and with the ease of deployment these days using services like AWS, it is just exacerbated.

I really hope I didn't go off on a slant here but with cases like Diaspora's design flaws, Gawker compromise, and now the Trapster fail, the trend's on the rise.

On that note, any recommendations or pointers on where to start from the security pros on here?! Thanks.

Use LastPass and generate random passwords, you'll just chuckle at the next company that does this rather than freak out...

I hope they do a post-mortem and explain where they went wrong.

Great. Now LinkedIn are going to reset my password again.

I'd like some sort of "guarantee". I want to sign up on websites that have some sort of seal: "We store passwords according to the XYZ spec". Some combination of bcrypt and comprehensive salting. If user data is ever compromised, users recourse to sue. Of course, no site ever do this because users just don't care and it would be a near-valueless liability.

I just don't understand how anyone can store a password in clear text. I have peers in college that couldn't edit the world's simplest VB6 application, but they know not to store passwords in cleartext.