Is Tesco putting your data at risk?

Tesco is facing criticism from the web security industry for how it is storing customer data. One blogger has raised concerns about the way passwords are being stored, and another expert has confirmed to AOL that some of the standards Tesco is using are 20 years out of date.

Tesco, meanwhile, insists it is not putting your data at risk, so what is going on?

Concerns

Concerns were raised by Troy Hunt, a security expert, on his blog. He said there were "a whole raft of basic, flawed practices which jeopardised the security and privacy of shoppers."

The initial issue started when Hunt asked the site to send him his password, and it did. This concerned him, because it means the way that passwords are stored are not encrypted. In technical speak they are ideally both hashed and salted. Tesco, Hunt said, was doing neither.


His concerns are shared by the security industry. Graham Cluley an expert at Naked Security told AOL: "Any website that can send you your password isn't storing it safely. Tesco doesn't appear to be following best practice in the way it is storing data. In some things it appears to be 20 years behind, with is inexcusable for a big brand like Tesco."

Tesco defence

However, Tesco does not share these worries. It issued a statement saying: "We know how important internet security is to customers and the measures we have are robust."

"We are never complacent and work continuously to give customers the confidence they can shop securely."

Cluley and Hunt are concerned by this too. Cluley explains: "Their response has been disappointing: just stating that their processes are robust. We would like to see them being proactive and say, 'yes they are robust, but in an abundance of caution we're going to improve them'."

Risk?

He highlights that at the moment there is no suggestion that any data has been exposed, and there has been no attack by hackers. He says: "In many respects this is nowhere near as serious as the situations where data has actually been hacked."

However, he adds that to protect themselves Tesco customers, and indeed all web surfers, should pay attention to their passwords. He says: "Make sure you are using a different password on each site, so that if one is exposed, it doesn't leave you vulnerable on others. Our research shows that 30% of people use the same password for everything, which is a huge mistake."

"You should also take care when choosing a password to ensure it's not easy to guess. Lots of people use things like 123456 or the name of the website itself, which is next to useless. Hackers can break passwords like this in a matter of seconds".

More stories

• The most commonly hacked passwords
• Beware what you share online
• How credit card cloning works
• Compare credit cards