360 Degree Safe - facepalm moment

[GuyJD]

I was looking at the https://www.saferinternet.org.uk/ website as Safer Internet day is next week and we have a few things planned for it, anyhoo they recommend assessing your online safety policy and practice by taking some time to fill in a a few multiple choice questions on the https://360safe.org.uk/ website.

 

So I registered on 360 Safe and the first thing they did was send me an email with my username and password that I had just set, now is it just me or does that not seem very 360 Safe? I mean c'mon a website set up to help you find flaws in your e-safety police and they are sending out passwords via email, what is this 1995???

Edited February 2, 2017 by GuyJD

[pete]

Aren't SWGFL behind that site?

 

Submit them to Plain Text Offenders

[GuyJD]

Aren't SWGFL behind that site?

They are which makes it even more worrying.

[SWGfL_Official]

Our apologies for this error. Just to reassure you we do not store any of our passwords in plain text. They are correctly hashed and salted before being stored in our database.

 

As you rightly pointed out though, the login creditials were being sent out upon registration, a feature which should have been removed during a security audit and upgrade conducted last year. This has now been corrected.

 

We take the security of our products extremely seriously, and strive to offer you the best service we can and will continue to monitor and improve our product security and features across our entire suite of applications.