Eircom Not Hashing their users @eircom.net passwords

teddy b123

Just thought I'd let you all know eircom are not hashing their eircom.net email passwords.

Was on the phone to them there (my email account wasn't working ) and was quite surprised when I had my password called out to me over the phone after answering only the most basic security questions (Which I got mostly wrong anyway).

Deliverance XXV

Wow. Am I surprised at their incompetence? Not really. No hashing and probably no random salting either. Time to start telling my €ircom registered friends to change their passwords :rolleyes:

gerryk

It's possible that this is in a separate database from the authentication database. I would hope so, in fact. I would hope that the internat facing authentication database is multiply salted, hashed and locked down, and that this is in some CRM system that is only accessibly over the corporate intranet. Not that this is acceptable either, but slightly less bad.

I have kicked it over to the Talk to... Eircom forum for comments.

Giblet

Now Tesco are in the firing line over this. I mean, who the hell is handling their security?

gerryk

Giblet wrote: »

Now Tesco are in the firing line over this. I mean, who the hell is handling their security?

Link?

MagicRon

http://www.troyhunt.com/2012/07/lessons-in-website-security-anti.html

knuth

Oak.6Tree.2 anyone?

Not one bit surprised.

mach1982

Giblet wrote: »

Now Tesco are in the firing line over this. I mean, who the hell is handling their security?

Security, IT is last thing big companies care about .

col.in.Cr

I had someone from 3v.ie ask for my password before and I told him I wouldnt give it out but he said he could see it anyway

gerryk

This sort of vulnerability/lack of duty-of-care is how that poor bollix at Wired got so thoroughly owned.

RUCKING FETARD