poor website security and disclosing of personal information

I started working for a food delivery company recently. As an employee you have an ''online profile'' with very sensitive information on it. The online profile has no two factor login and it has very poor password requirements. You can easily breach this online profile and the following information is availble on it:

1. A copy of your passport and driving licence which you can easily download.
2. Your name, address and telephone number.
3. Your bank account details and who you bank with.

I dont understand why this information is stored online. If you are an employee of a company, surely there are standards as to where this information is stored - common sense would suggest storing it offline.

Is there an authority where these practices can be reported to?

Thanks

B.A._Baracus

how easy we talking to get someones info?

the password requirement has a maximum of ten characters

the only thing you need to access this account is an email and password and thats it. everything is there for your viewing

DoctorEdgeWild

https://www.boards.ie/discussion/2058235726/poor-website-security-and-disclosing-of-personal-information

How is it easy to breach? Worrying about my own security as most of what I use is just behind a password too.

B.A._Baracus

Erm..... for a second I thought you were saying like a persons id (username) was set as the password. Like username: 315 and password: 315. Something stupid like that.

Most login systems are like that though. Sure even boards.ie here is only a password and not two factor. 10 characters is 10,000,000,000 combinations (thank you very much Google)

I don't get the issue. From a GDPR aspect, your data is hidden behind a password system. Not like you could go to: www.examplewebsite.com/users/315 and see everything without logging in.

DoctorEdgeWild

https://www.boards.ie/discussion/comment/118727015#Comment_118727015

Username: BABaracus

PW: AintGettingOnNoPlaneFool

I'm on to you now!

https://www.boards.ie/discussion/comment/118727015#Comment_118727015

10 characters:

If made up of just numbers can be cracked instantly

Same with just letters

letters and numbers = 1 hr

numbers and mix of UPPER/lower case letters = 1 month

upper/lower case letters, numbers and special characters = 5 years

It all depends on their password requirements.

B.A._Baracus

https://www.boards.ie/discussion/comment/118727068#Comment_118727068

It appears my google search was wrong. Here is the real odds:

https://www.computerworld.com/article/2832596/how-many-seconds-would-it-take-to-break-your-password-.html

10 characters: Possible combinations: 171.3 sextillion (171,269,557,687,901,638,419; 1.71 x 1020)

• Cracking online using web app hitting a target site with one thousand guesses per second: 54.46 million centuries.
• Cracking offline using high-powered servers or desktops (one hundred billion guesses/second) 54.46 years
• Cracking offline, using massively parallel multiprocessing clusters or grid (one hundred trillion guesses per second: 2.83 weeks.

As long as his password isn't password123 I think he is safe from this attack.

28064212

The Data Protection Commissioner is the authority here: https://www.dataprotection.ie/

Citizens Information has some specific info about the rights of employees: https://www.citizensinformation.ie/en/employment/employment_rights_and_conditions/data_protection_at_work/data_protection_in_the_workplace.html

thanks everyone for responses