nfl.com
Sports league
Wanted to bid on an NFL football. After registering and entering my credit card information (which is stored), they sent me my password in plain text. I’ve contacted them about the issue, but doubt I’ll get anything more than some lip service. I can only hope that the same team didn’t also work on the credit card storage system.
creditkarma.com
Credit and financial management service
Reset your password? Sure, here you go!
goshow.co.il
Show tickets
I never opened an account with them, but now I have a password that I can not change(!) and they display my National ID back to me when I log in! At least they don’t save my credit card details on the site… I hope.
icmodus.com, icgrouplp.com
Interactive promotions
Editor’s Note: Turns out Subway doesn’t care about password security when it comes to third party suppliers either.
vibramfivefingers.com
Shoe brand
They evidently store passwords in plain text, as we found out when we received the password reminder email. At least they use https on their order page (though the login and user information pages aren’t).
tcs.com
IT company
In order to apply for a job with them, you need to create an account (using the above url) and choose a password based on a pretty bad criteria. Then they send a mail to you containing the password in plain text for reference.
cooperativeenergy.coop
Energy provider
What makes it worse: The password is stored and can be used case-insensitive, and it cannot be changed online. Phone agents also have access, as they ask for password characters.
