Starbucks vows to beef up security on its iPhone app
Barista dismisses concerns about plain-text passwords for payment process
Computerworld - Starbucks today promised to update its iOS app to calm a storm of interest in a report this week that claimed criminals could easily nab the app's credentials from a stolen iPhone.
At the same time, Starbuck's CIO dismissed concerns raised by the report, but declined to go into specifics about the steps it has, and would, take.
"We have added several safeguards to protect the information you share with us," wrote Curt Garner in an open letter published on Starbuck's website Thursday. "To protect the integrity of these added measures, we are unable to share technical details, but can assure you that they sufficiently address the concerns raised in the research report."
The research Garner referenced surfaced yesterday after Computerworld columnist Evan Schuman reported that Daniel Wood, a Minneapolis, Minn. security researcher, had found that Starbuck's iOS app stored the customer's username and password in plain text. Sans encryption -- and with the app's practice of not asking for a password after it has been entered initially to activate the payment process -- a lost or stolen iPhone would give up the credentials.
Security experts Schuman spoke to criticized Starbucks for storing the passwords in the clear.
Garner also said that Starbucks would beef up the security of its iPhone app in a future update, but again did not go into details.
"Out of an abundance of caution, we are also working to accelerate the deployment of an update for the app that will add extra layers of protection," Garner wrote in the letter. "We expect this update to be ready soon and will share our progress here."
Starbucks' iOS app was last updated May 1, 2013, according to Apple's App Store.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is email@example.com.
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Malware and Vulnerabilities White Papers | Webcasts