#web insecurity

So lemme tell you a little story about an apartment complex here in Decatur, Georgia. Really nice premises, great floor plans. I've always enjoyed living here.

Until they decided to give me 48 notice of a mandatory pest inspection supposedly requiring extensive advance prep - which, granted, is a positive thing for a complex to new doing, and beneficial to the residents. Taken in combination with the fact that I am disabled, in dire straits, and fighting the clock to dispose of my belongings so I can move at the end of the month... perhaps less so. But surely, any reasonable firm could allow a bit of leeway, even a few days...? Nuh-uh. No compassion for YOU, bitch; bend over and take it.

So i struggled to meet their requirements, succeeding only in making things worse, throwing my back out in the process, and cursing them the whole time for making my life more difficult than it was already.

And then something interesting happened... for that value of "interesting" that makes me giggle when people toss around words like "random" and "coincidence" as if they had meaning.

I picked up a piece of paper with notes on it from the last time I'd had to call the complex's parent company. On that occasion, I'd forgotten which password I was using for the community's resident portal, so I'd used the "Forgot Password?" link... and had immediately received an email. Containing my password. Clear, legible, plain as day.

Some of you will know immediately what this represents; most will not, so allow me to explain. In a properly secure system, the password is encrypted prior to storage; upon login, the user-supplied password is encrypted and compared to the encrypted stored password to determine access rights. The basic principle of password encryption is that the unencrypted password remains solely the knowledge of the user - it cannot be deciphered directly, even by the people running the site. That's why a properly secured website will never send you your password, only a link to reset it - they can't send information they don't have.

The only way for my apartment complex's resident portal to be able to send me my password is if it had never been encrypted in the first place, but had merely been stored in plaintext. Which is such a terrible idea for so many reasons that it is nearly impossible to learn anything whatsoever about login systems and user authentication without having it hammered into your skull that this is something you should Never, Ever Do.

Yet here it was, plain as day, a coding blunder so massive that not even I, at my most clueless, had been so dumb as to do it - on an internet-accessible website containing the personal and financial data of most if not all of my community's residents - and potentially affecting residents of any other community using the same program.

So I did what any responsible former IT professional would do: i called up the complex, the parent company, and the software vendor, and left messages in each place: I found this issue, it is a potentially HUGE problem, you need to correct this asap.

And this and that and the other, culminating in a three-way combo between me, a rep from the parent company, and one from the vendor, in which the vendors rep assured us both that the problem had already been fixed in a recent code push, nothing to worry about.

I've actually worked in the industry, so naturally the first thing I did when I got off the phone was check. Of course, the vendor rep had been bullshitting; I'd expected no less. But i felt confident that no company, no master how ill-aspected, would be so stupid as to disregard a warning about such a blatantly stupid security issue, delivered in front of the client, no less. After all, it's not a hard fix to make; surely, no company would want to risk the type of attention they'd get if there were a security breach and this info came to light. Surely they'd slam a fix into place within a day or so. Right?

...hmmm.

As I stood there, weary and aching, I found myself growing more and more curious.

I went to the portal. I clicked the Forgot Password link and entered my email address. Then headed over to my email, and waited.

Same as it ever was: my password, shining back at me, clear as day, months after my alerting all parties to the issue and contrary to the vendors promises.

So I made another round of calls, gave the parent company all the relevant information, stressing that continued inattention to the issue was rapidly moving things to the point where my ethical obligation to help innocent consumers avoid a potentially dangerous situation would outweigh my ethical obligation to keep the information under wraps for their benefit.

Right up to the moment when the pest inspection team showed up at my door - along with the leasing manager, just to drive home the fact that I was utterly at their mercy, powerless to resist.

The moment when I looked at the manager and saw how much he was enjoying himself was, by utmost coincidence, the precise instant when I realized that I don't actually have any ethical obligation to this company whatsoever. Funny how that works.

So now I'm considering how best to proceed, and taking my time about it, mindful that promoting consumer awareness will also unfortunately draw exactly the kind of attention I'm worried about, and jeopardize people's bank accounts and safety. There's some small chance, I suppose, that my latest warning will reach the ears of someone who understands the problem and has the clout to get it fixed - instead of the inevitable clueless skeptic who shoots it down. Its only fair to give them the chance to deal with the issue or at least shut down the portal until it can be fixed.

But if i can't verify its been corrected before my move out date, when I lose access to the portal... Well, in a choice between protecting the concerns of innocent bystanders or a company that couldn't give the remotest fragment of a shit about my concerns, which would you pick?

The best part of the situation, in my view, is that it is not even remotely revenge: I discovered a potential issue, notified the appropriate parties discreetly, and months later there is still no change... its about protecting other folks like me, and maintaining a standard for proper treatment of personal data. My personal beef with the leasing company is irrelevant; the ethical choices and responsibilities are the same either way.

And yet, it is undeniable that if i had not been forced by events into last nights frenzy of activity, I might never have picked up that piece of paper - and in the current whirl of activity, might not have remembered the conversation about the security hole for years... if at all.

So I guess there are a few different morals to this story: first, that compassion is not just a virtue, but good business sense; second, that when a random person comes out of nowhere to warn you of a potential hazard, they might be worth listening to (how have people not yet learned this from horror movies?) and third, it might just be a good idea to ensure that the person who discovered a security flaw on your website and went to the trouble of discreetly warning you about it - AND who can also provide proof, in the event of a security breach, that your firm was made aware of the problem months before, yet failed too ensure it was fixed - might not ne the person who you want to piss off... because that next guy might not be as ethical as I try to be.