Unsafe Poker Rooms Get an Upgrade
Posted by Bill @ 4:30 amIf you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!
I haven’t really checked back recently since writing my posts on unsafe poker rooms that fail to encrypt your personal information but Brian over at MattahFahtu did take the time to check ‘em out and it looks like they’ve finally gotten around to correcting the problem.
I guess what really cooks my goose on this is that someone made a conscious decision to do this. This isn’t a case where you have two distinct pieces of software for .Net and .Com. Here was a piece of software that encrypted your password if you had a real money account and left your password completely exposed if you hadn’t made a deposit yet. In other words, you had code that looked something like this:
if(realmoney) {
encrypt_and_store();
} else {
just_store();
}
What possible purpose would there be in not encrypting the password? You had to go out of your way not to do it! In fact, if you later deposited funds, the software would presumably have to go and encrypt your password so not only did you have to go out of your way to write the unencrypted password but you had to write even more code that went and encrypted the password once a deposit was made.
Given the above, I’m going to guess this wasn’t just some rouge programmer who got lazy*. Instead, I’ve got to believe that some product manager spec’d it that way. For what goal I have no idea.
* There is one scenario where an incompetent programmer might have done this. It would be if that was his flag for whether an account was real or play money. There are at least 100 easier ways to flag that information but it is possible that is what the unencrypted value was being used for.
License
This work is published under a Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License.
If you enjoyed this post, please consider getting our free RSS feed so you can be notified of other posts like this.
- BROWSE / IN TIMELINE
- « The-Poker-Shark.com Scam
- » Spinning Bow Tie Costs Rick Moranis Celebrity Poker Tournament
- RELATED / YOU MIGHT FIND THESE INTERESTING
COMMENTS / ONE COMMENT
James added these pithy words on Sep 15 06 at 12:45 pmI’d guess the reasoning was that it would be worthwhile to be able to look up the passwords for play money players if they forgot them, instead of forcing a password reset.
SPEAK / ADD YOUR COMMENT
Comments are moderated.
