Korean Job Discussion Forums

[mindlessroller21]

I wanted to send out a warning to everyone of a dangerous security policy on the http://www.footprintsrecruiting.com/ website.

When you go to create an account there, two very insecure things happen:

1) When you enter your password into the password field it is displayed as plain text instead of being obscured by stars. Anyone near you will be able to see your password.

2) The password is then sent back to you in plain text in an email. Meaning anyone that a malicious third party could fairly easily find your password out if you are on a public network. On top of this https is not used so your information is being sent totally unencrypted just to make it that much easier.

3) Just a guess but your password will probably then be stored as an unencrypted string in their database forever just waiting for some outside party to come in and find it.

I would strongly suggest at a minimum using an alternate password if you use their website but I would honesty just encourage you to find a different recruiter.

Anyone who has such a careless attitude regarding your security is likely to engage in all sorts of poor business practices and really should not be trusted

Just my two cents.

[Chaparrastique]

Lol I doubt the worlds criminal masterminds stay awake at night trying to gain access to your cv on some hogwon website.

[drcrazy]

What about how often you see this when becoming a member of various on line sites???????? If they want my email address, that is ok. But I sure am not going to give them my password. What possible reason would they want that unless to read my email???????


Username: *
E-mail address: *
Password: *

Confirm password: *

[ttompatz]

[drcrazy]

[quote="ttompatz"]

[mindlessroller21]

Actaully drcrazy's post highlights the problem.

Many people use the same password for many websites.

So to address Chaparrastique, no they obviously dont care about your cv.

A malicious third party who has a list of email and passwords in plaintext can then use a script to try those combinations on every banking, email and major ecommerce site in existence in minutes if not seconds. They then sell of your accounts for a couple dollars and some guy in bulgaria clears out your bank account or racks up a couple grand on your paypal or ebay or amazon or whatever. With access to any one of those accounts it would possible to social engineer their way into your social securtiy info, and passport info if they were smart / devoted enough. It can and has ruined peoples lives.

Yes, it's serious, and it is a ridiculous violation of your identity, security and privacy for someone like footprints to have such crappy policies in place.

It would take them maybe one day and a couple hundred bucks to pay a consultant to fix something like this for them. It's not even remotely hard. The fact that they choose not to says alot to me about them as a company.

source: I am a programmer

[ttompatz]