Feeds

Top UK e-commerce sites fail to protect 'password' password-havers from selves

Really... you don't lock 'em out after multiple tries? - survey

5 things you didn’t know about cloud backup

Top UK e-commerce sites are not doing enough to safeguard users from their own password-related foibles, according to a new study.

A review of password security at the top 100 e-commerce sites found two in three (66 per cent) accept notoriously weak passwords such as “123456” or “password”, putting users in danger.

The first quarterly review by password manager and digital wallet firm Dashlane also found two in three (66 per cent) of e-commerce sites make no attempt to block entry after 10 incorrect password entries.

Sites that fail to implement rudimentary measures to block brute force attacks include Amazon UK, Next, Tesco and New Look. Hackers often run malicious software that can run thousands of passwords during log-ins to breach accounts, a tactic that a simple policy of locking out individuals after a given number of failed password entries would thwart.

Dashlane examined the e-commerce sites using a set of 26 criteria, including mandatory password length, acceptance of the 10 most commonly hacked passwords and whether or not they displayed users’ password in plain text. Each criterion was given a merit or demote point value, leading to a possible total score between -100 and 100 for each site.

Teletext Holidays, Urban Outfitters and Holland & Barrett received the three lowest scores. Virgin Atlantic and Ocado were also among the lowest ranked sites as they all received scores of -35 or below.

Apple is the best e-commerce site in terms of data protection, followed by Travelodge UK, which suffered from a data breach in 2011.

The IMRG CapGemini e-Retail Sales Index recorded 18 per cent year-on-year growth in December. This implies that consumers are increasingly sharing their personal data, including payment information, with a growing number of e-retailers but this confidence is resting on insecure foundations, according to Dashlane's review.

Mediocre as it might be, the UK is much more secure when compared to European neighbours France, where nearly one out of two sites send passwords, account confirmation or reset password emails in plain text email. UK sites did better than French sites in most categories but were outperformed by US sites, which scored better marks in a comparable review also run by Dashlane. ®

The essential guide to IT transformation

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?