TAB CSR's able to read passwords rather than reset.

Forums › IT Pro and developers › TAB CSR's able to read passwords rather than reset.

Distorter

219 posts

Master Geek

#154688 4-Nov-2014 15:33

Not sure if I am posting this in the right area, but found this quite bizarre.

I wanted to place a bet on the Melbourne Cup but couldn't remember my details to log into my account on the TAB website. So I rang their help line, once connected the CSR confirmed my details and then ......TOLD me what my password was.

Not that happy that they have a system in place that allows them to view passwords. Anyone from Catalyst on these forums? I believe they look after the TAB website.

Is this normal practice? Where I work most things are single sign on through ADFS and of course you can't read passwords from Active Directory.

amanzi

Amanzi
1285 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1168585 4-Nov-2014 15:35

No, that's never a good idea... What security checks did they do before reading you the password? How did you identify yourself?

AliExpress

Shop now on AliExpress (affiliate link).

Distorter

219 posts

Master Geek

#1168596 4-Nov-2014 15:39

My date of birth and the pin on my account. If I didn't know the pin, which I did, then they probably would've asked for email I assume.

nathan

5695 posts

Uber Geek
Inactive user

#1168609 4-Nov-2014 16:14

Sounds like they're Storing passwords using reversible encryption

That's not a sensible security best practice using plaintext versions of the passwords, they should be hashed

gcorgnet

1078 posts

Uber Geek

#1168611 4-Nov-2014 16:21

nathan: Sounds like they're Storing passwords using reversible encryption

That's not a sensible security best practice using plaintext versions of the passwords, they should be hashed

Aha! you seem to assume they are even using encryption.

If some CSR on the phone was able to dig out the password so easily, I would say the thing wasn't even encrypted. Really bad practices!
Always amazes me to realise something we just take for granted is actually missing from a lot of systems, even in big companies...