The Channel logo

News

By | Kelly Fiveash 21st January 2014 12:37

KCOM-owned Eclipse FAILS to cover up the password 'password'

Serves it in plain text to user via webpage

Exclusive A Register reader has exposed another privacy howler at KCOM - this time involving its Exeter-based ISP Eclipse Internet, which displays passwords in plain text to users via a webpage.

Customers who log in to their personal Eclipse user site are somewhat surprisingly shown the password for their account.

Today's tip of the hat from Vulture Central goes to Steve Foster, who got in touch following our story last week about a KC engineer allegedly revealing a spreadsheet containing unencrypted user IDs and passwords. He told El Reg:

I doubt that you'll be surprised that the utter incompetence within Kingston Communications goes further than Hull. At least as far as Exeter, in fact.

I attach a (redacted) screen grab from Eclipse Internet's management tool.

You'll see that they not only keep their passwords in plain text, they obligingly display them to you in full when you log into their website.

And yes, it does allow 'password'.

Anyone else feeling a tad bit insecure?

We asked KCOM to explain the lax security on display over at Eclipse Internet.

A spokeswoman at the company told The Reg:

Customers can view their password within our secure Eclipse customer portal only after they have logged in using their user name and password to authenticate their details. During the login process the password is not visible in plain text.

Which left your baffled correspondent wondering why the password would need to be displayed, if the same password was used to access the site.

We were also curious to know if there was any progress with the apparent KC spreadsheet blunder that El Reg recently uncovered.

But KCOM's spokeswoman told us there was "no update" on that particular story. ®

comment icon Read 46 comments on this article alert Send corrections

Opinion

Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella
Stranded_ships

Chris Mellor

Thousands of layoffs announced as spinning rust enters its death spiral

Features

STRASBOURG, JUNE 29, 2016: The seat of the European Parliament. by Marco Aprile for shutterstock. EDITORIAL USE ONLY
Plan b, image via Shutterstock
EU workers, new markets: post-Brexit pressure on May & Co
Tough question, pic via Shutterstock
Honest mistake with your licensing? Audit police look at it on a 'case by case basis'