Starbucks' iOS app found to store user credentials in plain text [u]

2»

Comments

  • Reply 21 of 31
    mstonemstone Posts: 11,510member
    Quote:

    Originally Posted by SolipsismX View Post



    I'm a big fan of Starbucks. I'm there pretty much every morning between 5 and 6am. I get up early but I don't want to make my own coffee at home and I like the (ironic?) social aspect of getting out and about early in the morning just to sitting someplace ignoring everyone around me whilst reading news on my computer. I like to study in public even if I'm not interacting with others. I think I need that visual stimuli as background noise for my brain.



    I guess I'm not a connoisseur of coffee since I go to Starbucks but they have something going for them I have rarely found elsewhere: consistency. I can go to any Starbucks and it will taste the same and yet it seems a barista at any other place can't replicate the same experience twice. Consistency is good, especially at 5 in the morning.

     

     

    The ambiance at Starbucks is nice enough. And for those who like routine, consistency has its merits. Apparently Starbucks also values consistency, as you noted.  The reality is that every coffee is inherently different, grown in a different climate, of a different variety, different soil, with different drying/washing/processing. The way Starbucks achieves consistency is by over roasting their coffee. After all, charcoal always tastes exactly like charcoal. To their credit, they now offer a Blonde product, (lighter roast) in bags, but they don't serve it in their restaurants as far as I know.

     

    In my opinion almost all coffee tastes terrible, bitter, acidic, and is definately an aquired taste. That is the primary reason people put so much milk and sugar in their coffee - to mask the bad taste of the black coffee. Super premium coffees naturally have a lot of sweetness and fruit-like nuances and drinking it black is the only way to experience that. Unfortunately Starbucks and most other coffee retailers do not buy super premium beans, so their coffee is almost always bitter tasting. I'm not a big fan of espresso either. There are some very nasty tasting oils in most coffees and when extracted under pressure they tend to be dissolved into the beverage. I've found that a very good way to brew coffee is with a simple Melitta single serve pour over paper filter. You still need to do every other step correctly before hand such as growing, processing, packaging, roasting and grinding, but proper brewing is very important. Large brewing equipment, such as the ones used in Starbucks is not really very good in terms of creating an ideal cup of coffee. I know I'm a bit of a coffee geek, but that is part of my job as a coffee grower.

     

    On rare occasion when I go to a coffee retail shop, I always pay in cash as it is a lot easier to tip the server. I never considered downloading the Starbucks app. Of course I almost never go to Starbucks unless someone asks to meet up there. Honestly, I don't use very many apps of any type. I did get my Adobe and Target IDs compromised recently. Very annoying. Digital transactions are becoming quite risky lately.

  • Reply 22 of 31
    "I use my StarBucks on my iPhone everyday and will stop going to StarBucks shops till end of Feb to show my objections to their complacency to the security of their customers."

    I'm sure Starbucks will die of embarrassment.
  • Reply 23 of 31
    From another article on this issue, it was explicitly mentioned that the attacker needs to have physical access to the phone. There is likely a LOT of personal data stored on peoples phones; it occurs to me their Starbucks account will be the lesser of their worries. If you lose your phone, it's a race to iCloud to wipe it!
  • Reply 24 of 31
    solipsismxsolipsismx Posts: 19,566member
    mactoid wrote: »
    From another article on this issue, it was explicitly mentioned that the attacker needs to have physical access to the phone. There is likely a LOT of personal data stored on peoples phones; it occurs to me their Starbucks account will be the lesser of their worries. If you lose your phone, it's a race to iCloud to wipe it!

    I seem to recall the problem with remote wipe is that you then lose the ability to track your phone, have it notify you when it comes back online, and have it display a message that could get the phone back to you.

    I think this may now be alleviated in iOS 7 with the Find My iPhone requiring your credintitals so it can be activated by a different user, but I'm not certain.
  • Reply 25 of 31
    smaffeismaffei Posts: 237member

    Yeah, but like I said the articles are only giving half the story.



    Crashlytics is a crash reporting tool for developers. It's used to collect and transmit crash information to a developer to potentially fix bugs discovered in the field. So, chances are, people's personal info was transmitted to Crashlytics in the crash reports. And, developers had access users' login information.



    Here take a look:



    http://try.crashlytics.com

  • Reply 26 of 31
    asdasdasdasd Posts: 5,686member
    Given you need physical access this is a non story.
  • Reply 27 of 31
    solipsismxsolipsismx Posts: 19,566member
    asdasd wrote: »
    Given you need physical access this is a non story.

    There is talk that your username and password may have been transmitted in plain text, too.
  • Reply 28 of 31
    Big deal, apps are all sandboxed everyone knows that. Security researchers need to up their game with the iPhone cause it protects again many basic programming incompetences like this one.
  • Reply 29 of 31

    Reality of outsourcing to do things the cheap way. Most utility app creation is given to low-cost developer companies in far flung countries. Heck, even bigger things like EA & Gameloft games.



    And these companies hire newbies & interns, pay them worse than peanuts, and expect them to learn off-the-work without 'wasting' any work hours, coz the client wants an 8-hour daily timesheet & pays almost bare minimum-wage per-hour money, by their own standards.



    And guess who gets the lion's share of even this money, the 'managers' of course. One thing I realised here, why managers cant do real development is because they are busy sweet-talking the lowly developers into cheap salaries & benefits for doing the real work.



    I am one of these, a one-year work-old developer hired by such a developer 'partnership'. The expectations of the clients - time-wise & effort-wise, and the money they offer in return are way apart. And we fight to get the crumbs from the manager.



    Back when I was a fresh graduate out of the university, I hadn't imagined how capitalism works out, in this way.

  • Reply 30 of 31
    macxpressmacxpress Posts: 5,810member
    Quote:

    Originally Posted by Rob Bonner View Post

     

     

    I have tried to go to smaller shops, and do myself enjoy Nespresso.  But do find it distasteful for you to use this forum as an outlet for your elitist coffee rants.  


     

    I think its distasteful to use the word distasteful in a discussion about a coffee company....So I find your post distasteful.

  • Reply 31 of 31

    Starbucks has admitted storing users’ passwords in plain text on its mobile apps, creating security and privacy risks. For more info visit

     

    http://www.technology91.com/starbucks-storing-passwords-in-plain-text/

Sign In or Register to comment.