I discovered a significant security vulnerability in Modernbill. Client account passwords are available to all levels of admin users in plain-text. This means that if an admin account gets hacked or if an employee gets disgruntled, passwords from all accounts can be collected and subject to a wide range of fraud activities. This also means that, considering that many people use the same passwords repeatedly, that people whose passwords are exposed are vulnerable to fraud in other areas as well.
Do similar vulnerabilities exist with other billing software?
did you report it to them before posting on a related industry forum? I mean, you know people are going to be PMing you looking for how to do this. Perhaps that was the intent? Either way, I hope you reported it to them in great detail so it can be fixed.
i posted this to modernbill and did not get a response from them. i think that (a) someone might recommend software without this problem, (b) the company might respond to the problem if more people are bothered by it, (c) maybe someone has a way to work around the problem.
There are two camps as far as passwords are concerned. The first is that passwords should be encrypted and the backend program should handle the recovery if the password is lost. The second are those who believe that it is a great service to the customer to tell them what their last password was and to do that it needs to be in plain text. I prefer the first. However the only time I would see this as a threat is if there is a vulerability in MB that would allow a cusomer to promote their login to administrator. I would think that MB would react quickly to a crittical vulnerability like that.
of course i want to to hire "trustworthy admins". who doesn't seek to hire trustworthy people? there is no objective measure of trustworthiness, and until there is, it is a security flaw to needlessly put passwords at risk.
Besides, we expect to be in business for a long time and, as with any business, expect a fair amount of growth and turnover. Even if the risk or a dishonest employee is tiny, that risk it will grow over time as we open ourselves to working with more people.
Well, if you think plaintext passwords are a problem, you probably HATE the 'Log in as John Doe' link that's right on the client view page, no?
Jacob - WebOnce Technologies - 30 Day 100% Satisfaction Guarantee - Over 5 Years Going Strong! Website Hosting, PHP4&5, RoR, MySQL 5.0, Reseller Hosting, Development, and Designs