Starbucks Mobile Payment App Stores Unencrypted Passwords

Starbucks Mobile Payment App Stores Unencrypted Passwords

  • By Ginger Hill
  • Jan 16, 2014

Starbucks Mobile Payment App Stores Unencrypted PasswordsStanding in line at Starbucks, I frequently see people whipping out their smartphones and scanning them to pay for their specialty coffee beverages and treats via the Starbucks mobile payment app. This, along with friends telling me I should, has almost convinced me to download the app, which would enable me to pay for my addiction directly from my smartphone, too. But, when I found out that this app linked to my bank account, this made me think twice. And, I’m sure glad that I did.

Apparently there is a report circulating in which Starbucks executives admit that the mobile app stores passwords in clear text, with no encryption whatsoever! Simply connect any smartphone with Starbucks’ mobile payment app downloaded onto it to a computer, and anyone can easily retrieve the password from a crash log.

As if that’s not bad enough, as of yesterday, it appeared that Starbucks had no intention of fixing the problem. Starbucks executives told the media that the company has “taken steps to safeguard customers’ information;” however these “steps” haven’t been identified publically. Besides, in order for a criminal to cause any damage, they would need to have physical possession of a user’s smartphone. Now, I don’t know about you, but trying to pry my smartphone from me is like trying to chisel concrete with a metal toothpick! I guess it could happen, but it’s not very likely.

While the Starbucks’ app only risks usernames, passwords and email addresses, moving over to “eating fresh,” Subway’s Ordering for California app stores complete street addresses, credit card info, email address and geolocation of app users in plain text.

Wonder what other fast food apps aren’t encrypted.

ARTICLE UPDATE: Starbucks CIO Curt Gartner issued a press statement saying that although “there is no indication that any customer has been impacted by this or that any information has been compromised” Starbucks will update its mobile payment app.

(Photo Credit: Sean Wandzilak / Shutterstock.com)

About the Author

Ginger Hill is Group Social Media Manager.

Featured

  • It Always Rains in Florida

    Over the years, and many trips to various cities, I have experienced some of the craziest memorable things. One thing I always count on when going to Orlando is a massive rainstorm after the tradeshow has concluded the first day. Count on it, it is going to rain Monday evening. Expect that it will be a gully washer. Read Now

    • Industry Events

  • Live from GSX 2024 Preview

    It’s hard to believe, but GSX 2024 is almost here. This year’s show runs from Monday, September 23 to Wednesday, September 25 at the Orange County Convention Center in Orlando, Fla. The Campus Security Today and Security Today staff will be on hand to provide live updates about the security industry’s latest innovations, trends, and products. Whether you’re attending the show or keeping tabs on it from afar, we’ve got you covered. Make sure to follow the Live from GSX page for photos, videos, interviews, product demonstrations, announcements, commentary, and more from the heart of the show floor! Read Now

    • Industry Events

  • Elevate Your Business

    In today’s dynamic business environment, companies specializing in physical security are constantly evolving to remain competitive. One strategic shift these businesses can make to give them the advantage is a full or partial transition to a recurring revenue model, popularly called a subscription service. This approach will bring numerous benefits that not only enhance business stability but also improve customer relationships and drive innovation. Recurring monthly revenue (RMR) or recurring annual revenue (RAR) are two recurring cadence choices that work simply and effectively. Read Now

  • Playing a Crucial Role

    Physical security technology plays a crucial role in detecting and preventing insider cybersecurity threats. While it might seem like a stretch to connect physical security with cyber threats, the two are closely intertwined. Here’s how physical security technology can be leveraged to address both external and internal threats. Read Now

Most   Popular

Featured Cybersecurity

Webinars

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3