Microsoft India stores plaintext passwords

Internet

From the Times of India Enterprise IT section, emphasis added:

NEW DELHI: Hackers, allegedly belonging to a Chinese group called Evil Shadow Team, struck at www.microsoftstore.co.in on Sunday night, stealing login ids and passwords of people who had used the website for shopping Microsoft products.

While it is troublesome that hackers were able to breach security at a website owned by one of the biggest IT companies in the world, it is more alarming that user details – login ids and passwords – were reportedly stored in plain text file, without any encryption.

Absolutely inexcusable security in 2012. My only hope is this was a dodgy contractor doing shoddy work, and doesn’t represent standard Microsoft Store policy.

Author bio and support

Me!

Ruben Schade is a technical writer and IaaS engineer in Sydney, Australia who refers to himself in the third person in bios. Wait, not BIOS… my brain should be EFI by now.

The site is powered by Hugo, FreeBSD, and OpenZFS on OrionVM, everyone’s favourite cloud infrastructure provider.

If you found this post helpful or entertaining, you can shout me a coffee or buy some silly merch. Thanks!