TAB CSR's able to read passwords rather than reset.

Forums › IT Pro and developers › TAB CSR's able to read passwords rather than reset.

Distorter

185 posts

Master Geek

#154688 4-Nov-2014 15:33

Not sure if I am posting this in the right area, but found this quite bizarre.

I wanted to place a bet on the Melbourne Cup but couldn't remember my details to log into my account on the TAB website. So I rang their help line, once connected the CSR confirmed my details and then ......TOLD me what my password was.

Not that happy that they have a system in place that allows them to view passwords. Anyone from Catalyst on these forums? I believe they look after the TAB website.

Is this normal practice? Where I work most things are single sign on through ADFS and of course you can't read passwords from Active Directory.

amanzi

971 posts

Ultimate Geek

Trusted

#1168585 4-Nov-2014 15:35

No, that's never a good idea... What security checks did they do before reading you the password? How did you identify yourself?

Distorter

185 posts

Master Geek

#1168596 4-Nov-2014 15:39

My date of birth and the pin on my account. If I didn't know the pin, which I did, then they probably would've asked for email I assume.

nathan

5686 posts

Uber Geek

Trusted

Microsoft

#1168609 4-Nov-2014 16:14

Sounds like they're Storing passwords using reversible encryption

That's not a sensible security best practice using plaintext versions of the passwords, they should be hashed

populism, the most important and misunderstood movement of our time

gcorgnet

894 posts

Ultimate Geek

Subscriber

#1168611 4-Nov-2014 16:21

nathan: Sounds like they're Storing passwords using reversible encryption

That's not a sensible security best practice using plaintext versions of the passwords, they should be hashed

Aha! you seem to assume they are even using encryption.

If some CSR on the phone was able to dig out the password so easily, I would say the thing wasn't even encrypted. Really bad practices!
Always amazes me to realise something we just take for granted is actually missing from a lot of systems, even in big companies...