The Student Room Group

Why is UCAS security inadequate?

Whilst I understand you use SSL and have done attack testing and you believe your databases are secure & advisors cannot read them, you still store users passwords in plain text.

It would not be unreasonable to hash the passwords to make them pretty much irretrievable in event of a breach. It would mean passwords aren't emailed out in plain text as they are right now and you would have to follow a password reset process but given that many people will use the same password for UCAS as their e-mail, Facebook, Twitter, possibly even their banking, a break-in/hack/attack/whatever would be devastating for UCAS reputation and it's users.

When will UCAS begin to take security of its users seriously and encrypt passwords inside their system?

It may sound obscure or whiney or whatever, but it never really seems like a problem until something goes wrong.

Thanks,
Andrew.

Quick Reply

Related discussions

Latest

Trending

Trending

Articles for you