Equifax sends passwords insecurely in plain text leading to potential identity theft

The credit bureau Equifax claims to take various precautions regarding their customers’ personal information, and attempts to combat identity theft. However, if you ever need to contact their customer service for any reason (being locked out of your account, resetting your password, et cetera), they will send you your password in plain text. You might wonder why this is a problem, so let me tell you. When an individual sends an email, they type it in an email client like Thunderbird, Mail, Outlook (all known as Mail User Agents [MUAs]). The MUA then sends that email to a mail server running software to relay mail, such as Postfix, Exim, Qmail (known as Mail Transfer Agents [MTAs]). These MTAs then relay the mail to the recipient mail server, and the recipient’s MUA connects to his or her MTA in order to retrieve it. Basically, it looks like the following flowchart:

Sender’s MUA –> Sender’s MTA –> Recipient’s MTA –> Recipient’s MUA

or with examples, it may be:

Thunderbird –> Gmail –> Apple’s .me mail server –> Mail application in Mac

In between the sender’s MUA and the sender’s MTA, the email (which is broken down into packets of data) may pass through many different switches, routers, and other networking equipment. In between the sender’s MTA and the recipient’s MTA, the data will pass through even more networking gear. And you guessed it, it will pass through even more pieces of networking equipment from the recipient’s MTA and the recipient’s MUA. During this chain of transfers, if the data is unencrypted, the text contained in the email can be intercepted and read without any problem. Therefore, sending a password in plain text provides many opportunities for that password to be intercepted, read, and subsequently, used by the interceptor to log in to the account.

Equifax, a purportedly reputable firm that handles sensitive financial and personal information about its customers, sends passwords to their customers’ respective email addresses in plain text (without encryption)! They are trying to help prevent identity theft, but don’t seem to safeguard their customer accounts very well! This HUGE oversight makes me wonder if they are also storing customers’ credit card numbers in plain text in a database, or even Social Security Numbers (SSNs).

Add Equifax to the list of companies that really should hire a security consultant before being trusted with personal information.

|:| Zach |:|

Goodbye Aristotle

Today, I am retiring one of my previous servers, Aristotle. It has been a good machine, but I no longer need it because it has been replaced by a newer machine in a different datacentre. It had a good run of a couple years, with a nice uptime:

bsbc-aristotle aristotleadmin # w
18:22:34 up 475 days, 20:43, 1 user, load average: 0.00, 0.00, 0.00
USER TTY LOGIN@ IDLE JCPU PCPU WHAT
aristotl pts/1 18:22 0.00s 0.02s 0.00s sshd: aristotleadmin [priv]

|:| Zach |:|

Tony Pugliese and Alex Mancuso on North Carolina’s proposed gay marriage ban

Today on the North Carolina news station WRAL-5, my cousin Anthony Pugliese and his partner, Alex Mancuso, were interviewed regarding the proposed amendment to ban gay marriage across the state. The amendment is set to be on the ballot on 08 May 2012, and currently, it seems like there are many more individuals who favour the amendment than those who oppose it. Below, I have quoted the entire article that was presented on WRAL’s website this afternoon:

RALEIGH, N.C. — A proposed constitutional amendment that would define marriage in North Carolina as being between one man and one woman has broad support among voters statewide, according to a new WRAL News poll.

Amendment One, which would effectively bar any same-sex union in the state, will appear on the May 8 primary ballot.

SurveyUSA polled 1,001 likely voters across North Carolina between last Friday and Tuesday and found that 58 percent support the referendum. Thirty-six percent of voters oppose it, and 6 percent remain undecided.

The poll has a margin of error of plus or minus 3.1 percentage points.

Although North Carolina law already prohibits same-sex couples from marrying, it is the only state in the Southeast without such restrictions written into its constitution.

The marriage amendment has split the state in recent months, with even President Barack Obama and the Catholic church weighing in. Obama spoke out last week against the amendment, and North Carolina’s two Catholic bishops responded Wednesday by calling the president’s position a “disappointment.”

Amendment opponents say the measure would enshrine discrimination in the North Carolina constitution and could have unforeseen consequences.

“Any time the majority makes decisions on behalf of the minority, it’s hurtful. It’s wrong,” said Anthony Pugliese, who is raising two daughters with his partner of 15 years, Alex Mancuso.

The amendment is “taking a bad law and making it even more pronounced. It’s elevating it to another level,” Pugliese said.

Mancuso said the couple view themselves as a normal and traditional family.

“The way we’re bringing the children up with love and caring (and) trying to make them as healthy as they can be, that’s why I guess I’m saying we’re traditional,” he said.

Supporters say marriage is not a right, and the amendment would protect the traditional institution of marriage from court rulings allowing same-sex couples to wed.

“The point is, we’re trying to allow the people to decide by allowing them to vote May 8th and not allow an activist judge to decide for us,” supporter Tyler McNabb said. “Marriage is an institution that was created by God.”

Both sides have held rallies in recent weeks to energize their bases in advance of the primary.

The WRAL News poll shows the amendment has broad support across most segments of the population.

More than 60 percent of men and 55 percent of women back the proposal. Along racial lines, 61 percent of white voters and 56 percent of black voters support it.

Support for the amendment appears to increase with age, from 50 percent among 18- to 34-year-olds to 65 percent among those age 65 and older.

Independent and moderate voters were the only demographic segments where amendment opponents held a slight advantage – although it was within the margin of error in both instances.

Among independents, opposition to the amendment is running at 47 percent, compared with 45 percent for supporters. Democratic voters are evenly split on the issue at 46 percent a side.

Voters identifying themselves as moderate oppose the amendment by a 46 to 44 percent margin.

A recent Elon University poll found that 58 percent of North Carolinians oppose the amendment, with 38 in favor of it. That poll surveys adults statewide, while the WRAL News poll includes the results only of likely voters.

Despite the broad amendment support in the WRAL News poll, only 37 percent of voters said same-sex couples deserve no legal recognition in North Carolina, according to the poll. Twenty-one percent said they should be allowed to marry, 19 percent said they should be eligible for domestic partner benefits and 17 percent said civil unions should be permitted in the state.

McNabb called those numbers “a red herring” that distracts from the overall debate on the amendment, but Pugliese said he thinks they show that people don’t really understand the amendment.

Reporter: Bruce Mildwurf
Photographer: Greg Clark
Web Editor: Matthew Burns

Further, just in case the video clip of the newscast is removed, I have embedded it here locally on the Z-Issue. Feel free to watch it by simply clicking the play button below:

Anthony Pugliese and Alex Mancuso on the proposed gay marriage ban in North Carolina, United States:

Surprisingly, I think that the WRAL team did a fairly decent job presenting the issue in a reasonably unbiased manner. Both sides were given attention, without many references to the anchors’ personal opinions. Congratulations Tony and Alex for showing the North Carolina viewers a lovely family with same-sex parents upholding traditional values.

|:| Zach |:|