Use MathsWhizz? Security warning!

[deKay]

I'd imagine a fair few of us use MathsWhizz here. I stumbled across something quite important today.

 

It seems that many, possibly all, schools have the same admin password (I won't mention it here, but it ends with a 3 if you have yours to hand). And, since the admin usernames are trivial to guess (they're the name of the school), well - you can see where this is going.

 

Firstly, MathsWhizz must change things - so that admins are either given a unique password, or at least force a password change at first logon.

 

Secondly, admins must be able to change their own password. There's no functionality on the site, I had to call them but...

 

...when I called them, the only proof they asked for to determine which school I was calling from was the name of the school! No username, postcode, phone number - nothing. Even when they asked for my name and email address there's nothing on their records as to who I am - it was our Maths dept that set it all up, not me!

 

So, I urge everyone to call them up (0203 328 6564) and get your passwords changed ASAP. I'm going to contact them to ask for them to do something more.