poor website security and disclosing of personal information

03-03-2022 05:20PM #1

I started working for a food delivery company recently. As an employee you have an ''online profile'' with very sensitive information on it. The online profile has no two factor login and it has very poor password requirements. You can easily breach this online profile and the following information is availble on it:

A copy of your passport and driving licence which you can easily download.
Your name, address and telephone number.
Your bank account details and who you bank with.

I dont understand why this information is stored online. If you are an employee of a company, surely there are standards as to where this information is stored - common sense would suggest storing it offline.

Is there an authority where these practices can be reported to?

Thanks

B.A._Baracus · 03-03-2022 05:23PM

how easy we talking to get someones info?

03-03-2022 05:24PM

the password requirement has a maximum of ten characters

03-03-2022 05:29PM

the only thing you need to access this account is an email and password and thats it. everything is there for your viewing

DoctorEdgeWild · 03-03-2022 05:52PM

https://www.boards.ie/discussion/2058235726/poor-website-security-and-disclosing-of-personal-information

How is it easy to breach? Worrying about my own security as most of what I use is just behind a password too.

B.A._Baracus · 03-03-2022 05:58PM

Erm..... for a second I thought you were saying like a persons id (username) was set as the password. Like username: 315 and password: 315. Something stupid like that.

Most login systems are like that though. Sure even boards.ie here is only a password and not two factor. 10 characters is 10,000,000,000 combinations (thank you very much Google)

I don't get the issue. From a GDPR aspect, your data is hidden behind a password system. Not like you could go to: www.examplewebsite.com/users/315 and see everything without logging in.

DoctorEdgeWild · 03-03-2022 06:01PM

https://www.boards.ie/discussion/comment/118727015#Comment_118727015

Username: BABaracus

PW: AintGettingOnNoPlaneFool

I'm on to you now!

03-03-2022 06:05PM

https://www.boards.ie/discussion/comment/118727015#Comment_118727015

10 characters:

If made up of just numbers can be cracked instantly

Same with just letters

letters and numbers = 1 hr

numbers and mix of UPPER/lower case letters = 1 month

upper/lower case letters, numbers and special characters = 5 years

It all depends on their password requirements.

B.A._Baracus · 03-03-2022 06:10PM

https://www.boards.ie/discussion/comment/118727068#Comment_118727068

It appears my google search was wrong. Here is the real odds:

https://www.computerworld.com/article/2832596/how-many-seconds-would-it-take-to-break-your-password-.html

10 characters: Possible combinations: 171.3 sextillion (171,269,557,687,901,638,419; 1.71 x 1020)

Cracking online using web app hitting a target site with one thousand guesses per second: 54.46 million centuries.
Cracking offline using high-powered servers or desktops (one hundred billion guesses/second) 54.46 years
Cracking offline, using massively parallel multiprocessing clusters or grid (one hundred trillion guesses per second: 2.83 weeks.

As long as his password isn't password123 I think he is safe from this attack.

03-03-2022 06:12PM

The Data Protection Commissioner is the authority here: https://www.dataprotection.ie/

Citizens Information has some specific info about the rights of employees: https://www.citizensinformation.ie/en/employment/employment_rights_and_conditions/data_protection_at_work/data_protection_in_the_workplace.html

04-03-2022 12:30PM

thanks everyone for responses

poor website security and disclosing of personal information

Comments