Soo Many Passwords and Useless Accounts

A new Web 2.0 site launched last week. It is focused on its core competency like a laser, which is needed for the success of any young company.  UselessAccount.com allows users to create an account and... well...that is actually all it does.  In the words of Alan Graham of ZDNET, usellessacount.com "does one thing and it does it very well."

Now I think this site was made in jest, or as a viral marketing spoof by its creator Brisbane Creative.  But it raises an important issue: password security in the digital age.

I love new web applications and I am always creating new accounts in order to really dive into new web tools.  One of my new favorites is Geni.com (it is a web 2.0 social networking site that revolves around your family tree...very addictive).

Here at HotPads we take security very seriously.  We don't even have sensitive information on our site, but all passwords are encrypted to ensure the safety of our users' information (because passwords are encrypted, even HotPads' engineers cannot read the passwords in the database).  Encryption of passwords is fairly typical.

A couple weeks ago, someone here at HotPads lost their password for their electronic paystubs.  I called our payroll services provider (one of the largest in the country) and a customer service representative read me the passwords for the entire company.  I was first surprised that the rep would give me the passwords rather than just resetting them.  Then, after some thought, I became shocked that this employee actually had access to our passwords.  Because it is a payroll services company, employees also have access to HotPads' social security numbers, bank routing numbers, and checking account numbers.

I am not particularly sure what the process is to steal someone's identity, but I am pretty sure that this is a bad combination of data if put into the hands of a deviant.

Moral of the story:
Companies - Protect your users' information
Users - Protect yourself

My password for UselessAccount.com is "xxDvb7#4shepherd13."  Fortunately, I doubt I will ever need to sign-in again.

Comments

[Dave]

couldn't agree more:
http://500hats.typepad.com/500blogs/2007/02/silicon_valley_.html