iTWire recently wrote in somewhat glowing terms of the steps Nvidia took to ensure the web access accounts of its customers were well protected.
We can give no such praise to whoever built Billabong's website.
According to a dump from their password database, Billabong stored all passwords in plain text - presumably this made it easier to tell a user what their password was if they'd forgotten it. It also made life very easy for any hackers who wished to masquerade as the users on the site.
|
Until SC Magazine brought the breach to Billabong's attention, the company was entirely unaware of the problem.
It appears that all accounts have been disabled, but the total lack of ANY advice from the company on their website is very concerning - the average user will not know that their password (possibly used elsewhere) is visible in plain text.
The company has been contacted for comment.