Yahoo-owned Tumblr has pushed out a fix for its iOS app, after claims it was not using encryption to keep users’ passwords safe.
Tumblr issued an update yesterday, urging all users to change their passwords as a precaution. “We have just released a very important security update for our iPhone and iPad apps addressing an issue that allowed passwords to be compromised in certain circumstances,” the blogging company said in a blog post, revealing little else.
It did hint that secure sockets layer (SSL) was not implemented properly, by saying passwords could be “sniffed in transit on certain versions of the app”.
A reader of The Register claimed the iOS apps was not logging users in over an SSL server, meaning plain text passwords were being sent between phones and servers. Hackers sitting on the same network could easily intercept such passwords and compromise a Tumblr account, and any other site using similar login credentials.
The threat becomes considerably more severe where the Tumblr user is on an unprotected Wi-Fi network.
It appears the app uses SSL after login, but not before – a serious security failure in many professionals’ eyes.
Many Internet services do SSL badly, as TechWeekEurope discovered last year in an investigation into security on university websites.
What do you know about Internet security? Find out with our quiz!
Rights group argues ChatGPT tendency to generate false information on individuals violates GDPR data protection…
European Commission says Apple's iPadOS is 'gatekeeper' due to large number of businesses 'locked in'…
As the cloud continues to be an essential asset for all businesses, developing and maintaining…
Internatinal conference in Vienna calls for controls on AI-powered autonomous weapons to ensure humans remain…
Major Taiwan chip assembly and test firm KYEC to sell Jiangsu subsidiary, exit mainland China…
As deepfake technology continues to blur the lines between reality and deception, businesses and individuals…
View Comments
Great article, this is a surprising security oversight by Tumblr, since this type of security measure is not difficult to implement.
For users interested in protecting themselves. We have written out some steps you can take to protect your data from this type of flaw.
http://www.doctrackr.com/blog/bid/318540/Is-Your-Social-Media-Secure-Privacy-Tips-from-Tumblr-s-Failure