What experiences are people having with Sam Learning as a learning platform? We have been looking into it for use in our school but i have been met with some interesting security challenges which brings me to question the platforms security and/or technical competency.
I take data security seriously and like to explore/test each platform prior to submitting any sensitive data. Other than the usual Data impact assessment, checking privacy policy and terms of service etc i also test the platform for password security and the potential for misuse (but i'm no a programmer).
Would you have have any concerns if an online learning platform did the following or am i being to cautious (taking into consideration staff accounts would have access to fields defined as Sensitive under GDPR, ethnicity, FSM, Care status)?
When testing i found that if a teacher resets their password the system emails them a new password in clear text that is the username and the Unix date/time code
Password: tman1671021086Password: tman1671020842Password: tman1671020777
The email is sent via a 3rd party tool (Send Grid), when you next login you are not forced to reset your password you would manually have to go to the settings to change it.
If an admin resets the password for a teacher the password is simpilly set to the teachers username and emailed to them... again without prompting them to change it.
Example
"You have been granted a personal login to SAM Learning. Your login details are as follows: User ID: xxx Password: xxx This account is unique to you and it will enable you to personalise your SAM Learning experience. If at any time you wish to change your password, please login to the site and go to: Profile > My Password If you have any questions, you can contact our Support Team"
As of this morning the whole password reset, find center ID etc isn't currently working at all (tested on a private device non filtered internet), cannot find email address, cannot find post code etc.
What are your thoughts.
Dan
