Evan Schuman: Starbucks releases fix for mobile app

No independent verification yet that the problem has been eradicated

Starbucks late Thursday (Jan. 16) posted a new version of its iOS mobile-payment app, one that the company says fixes the password-in-plain-text situation that I reported on Wednesday (Jan. 15). I have been unable to verify as yet whether the new version does indeed halt the key problems with the earlier version, which also disclosed in clear text account name, email address and geolocation details.

Daniel Wood, the security researcher who first discovered the holes -- and who, at Computerworld's request late on Tuesday, reran the tests after Starbucks said it had imposed additional security protections -- said today that he is "almost 100% certain" that the clear-text password problem is gone. "The file that was containing that data is no longer storing that data," he said, adding that he is still "checking to see if [the sensitive data] is trapped somewhere else." The passwords and related info are now saved in Apple's encrypted keychain, Wood said.

It should be pointed out, though, that Wood is no longer the independent security researcher that he was two days ago, since Starbucks has now brought him on as a security consultant, along with the standard nondisclosure agreement. Wood said it is, at this time, an unpaid role.

Evan Schuman has covered IT issues for a lot longer than he'll ever admit. The founding editor of retail technology site StorefrontBacktalk, he's been a columnist for CBSNews.com, RetailWeek and eWeek. Evan can be reached at eschuman@thecontentfirm.com and he can be followed at twitter.com/eschuman. Look for his column every Tuesday.

Read more about mobile payments in Computerworld's Mobile Payments Topic Center.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags Applestarbucksmobile payments

More about AppleindeedStarbucksTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Brand Page

Stories by Evan Schuman

Latest Videos

More videos

Blog Posts