Starbucks Admits It Stores Unencrypted User Passwords, Location Data in iPhone App

[mgroover]

Do hipsters still hang out at Starbucks? I thought it would be regular Joe Schmuck-people.

The "real" hipsters would most likely be sitting barefoot, scratching their 17th century style ironic beard, listening to obscure music from obscure artists no-one has heard of (not heard due to pure musical reasons) with their new iPad Air, writing a intricate self biography/action cross-over drinking Blue Mountaindrip coffee or espresso macchiato in the closest place that has a trendy tatooed hipster barista?

 

[Shrink]

Do hipsters still hang out at Starbucks? I thought it would be regular Joe Schmuck-people.

The "real" hipsters would most likely be sitting barefoot, scratching their 17th century style ironic beard, listening to obscure music from obscure artists no-one has heard of (not heard due to pure musical reasons) with their new iPad Air, writing a intricate self biography/action cross-over drinking Blue Mountaindrip coffee or espresso macchiato in the closest place that has a trendy tatooed hipster barista?

My...my...such a wonderfully pleasant and amazingly clever post.

All those Joe Schmucks and obscure music listening hipsters out there...take note!

 

[ThunderSkunk]

Not that anyone was asking for another reason to avoid Starbucks, but...
call it the company that keeps on giving.

 

[fhall1]

After all the brouhaha of late about privacy and security, whoever wrote this App, what were they thinking…..?

To save money....someone in Starbuck's IT department said "hey anyone here use iPhones and have a Mac....could you load up Xcode and develop a quick and dirty app for us?

Probably very little in the way of security review once it was complete, they just wanted to know "if it worked".

 

[BornAgainApple]

After all the brewhaha of late about privacy and security, whoever wrote this App, what were they thinking…..?

fixed

On topic, Starbucks should be fined for this.

 

[Chupa Chupa]

Glad I don't have a Starbucks app in my country. Good luck cleaning that up, Starbucks.

Why because you hate convenience and free drinks and discounts?

With all the insecurity in computer systems these days (Target, Neimans) the Starbucks app is really only a distraction. Someone would have to have physical access to your phone or backup file to get the UID and PW. And even then you are talking about credit for coffees. What's the downside here - $20.

----------

Do hipsters still hang out at Starbucks? I thought it would be regular Joe Schmuck-people.

No, the Joe Schmuck people hang out on MR and spend their day generalizing and being snarky and condescending about people they don't even know.

 

[rdinterman]

Having worked for Starbucks a couple of years ago, I was surprised how bad their systems were for being such a cutting edge company. It is disappointing the lack of attention to the iOS app as so many of their payments are now mobile. I also heard last year the app was going to be updated so you could include an optional tip. This has not happened either.

 

[2457282]

Oh my, someone could steal my double frap, Skinny Caramel Macchiato with extra Caramel (What the heck is that stuff anyway?)

Okay, security is serious and this app has been officially removed from my device.

 

[knightlie]

Why because you hate convenience and free drinks and discounts?

Personally, I hate going anywhere where asking for "a cup of coffee" produces a blank look...

 

[mgroover]

No, the Joe Schmuck people hang out on MR and spend their day generalizing and being snarky and condescending about people they don't even know.

The point of the post was that I just don't see how StarBucks is a place for hipsters?
Do hipsters tend to eat at McD/BK/KFC?
Do they drink Millers/Bud Light?

No, they are at a newly opened food truck with organic soy bean protein burgers (or better, a cow offed directly behind the food truck and grinded to perfect mince that makes perfect patties) trying to find something new and unique they can eventually be "first" about and then moving on to something new unique complaining about how they did it "ages ago".

Eventually they fall in to some kind of social thing anyway and do the same thing everyone else does.

Average Joe Schmuck was a bad word from my side early in the morning, it's called Jane/John Doe. Or "Svenssons" as we say here in Sweden. The regular average person.

Which was my impression of Starbucks when I was over there. Extremely bad coffe to a slightly premium price for the average consumer that doesn't care.

Oh, it seems as if they've done the same "boo-boo" on all platforms as it's being reported about on the Android news pages as well.

 

[Chupa Chupa]

Personally, I hate going anywhere where asking for "a cup of coffee" produces a blank look...

That's a lot of places though. I mean "cup of coffee" is quite ambiguous & generic. Unless you are at a sit down restaurant or cafe, most coffee shops have multiple sizes.

Average Joe Schmuck was a bad word from my side early in the morning, it's called Jane/John Doe. Or "Svenssons" as we say here in Sweden. The regular average person.

Which was my impression of Starbucks when I was over there. Extremely bad coffe to a slightly premium price for the average consumer that doesn't care.

Yes, "Jane/Jone Doe" has quite a different connotation than "Joe Schumuck." The former is accepted slang for the average person. The latter, of course, is, meant to be offensive; from the yiddish translation, a "d!ck."

Coffee, like people, comes in all different tastes and strengths. Yes, Starbucks has some awful blends, but they have some tasty ones too. I can say the same about the offerings of lots of restaurants. Can't you?

But, honestly the big draw to Starbucks coffee over other coffee shops is not that it's a gourmet delicacy. People buy the drip because its extra caffeinated. If you need your morning caffeine bump that's the place to go. Also Starbucks has a variety of espresso drinks that most shops don't have or are not convenient. Finally, it's a comfortable (usually) place to meet for a casual cup. People like to jab Starbucks the same way they jab Apple. Sometimes its deserved, but most times its just petty, baseless & spiteful.

 

[ArtOfWarfare]

That's so stupid. Did they hire some Java hacker in 7th grade to code this? No, the 7th grader would at the very least use a Caesarian Shift.

Wait, other seventh graders did that too? I thought I was clever when I did it...

Not that I even knew what the name of it was until last year when I took a class on Computer Security.

 

[cymerc]

Why are they storing our location data in the first place?

 

[slu]

You know all those "crazy people" who always come up with paranoid conspiracy theories? The ones that keep saying "your phone is being tracked by the government! Big companies are selling your information to other companies! We are all being spied on!"?

Well I hate to admit it but they were right all along!

I really hope I am just missing the sarcasm here. Becauae I don't see how this story has anything at all to do with your post...

 

[unplugme71]

Damn, I wonder if DropBox, Google, MSFT, IFTT, Hue, or anyone else has done this in their apps.

Luckily with 1Password all mine are different, thankfully, especially after the Target incident. Who knows how much more they'll discover with it.

Now I'm debating if I want to use different usernames as well and create email aliases for each of these accounts... ie - unplugme71_target@someservice.com unplugme71_starbucks@someservice.com

 

[RedOrchestra]

Well it is a place where hipsters show off their ipads and Mac Books.

YEP, you stick out like a three-headed monster with anything other than Apple stuff!

 

[GoCubsGo]

I would have thought that Starbucks with their infinite flow of cash would have at least hired a developer that would have taken security into account.

Can't wait to see how they're going to clean up this mess.

Do hipsters still hang out at Starbucks? I thought it would be regular Joe Schmuck-people.

The "real" hipsters would most likely be sitting barefoot, scratching their 17th century style ironic beard, listening to obscure music from obscure artists no-one has heard of (not heard due to pure musical reasons) with their new iPad Air, writing a intricate self biography/action cross-over drinking Blue Mountaindrip coffee or espresso macchiato in the closest place that has a trendy tatooed hipster barista?

I feel as though your post suggests you weren't quite accepted into the hipster club and now you're lashing out.
FWIW, I am far from a hipster, I don't fit the requirements both in age and physical appearance, but I have drank Blue Mountain coffee and I enjoyed the **** out of it.

 

[hansonjohn590]

When I was learning objective-c, it's one of the first things I learned.

It's really incredibly easy to hash a password, there's really no excuse. If Starbucks hired somebody do create this app, that company should be outed publicly.

 

[benjai]

but users of the app who had the "auto replenish" feature on would enable criminals to continually add money to the app to make Starbucks purchases.

So the worse that can happen if your phone gets stolen is that they drink a lot of coffee? I mean, how much can one spend in starbucks in a day?

 

[D.T.]

Double quoting the double awesomeness

Someone would have to have physical access to your phone or backup file to get the UID and PW. And even then you are talking about credit for coffees. What's the downside here - $20.

Yeah, if you think about the real exposure this creates. It’s not like the PW stored as clear text in and of itself is all that bad (assuming it’s sent across a secure connection and you use public APs). *If* your phone gets stolen, and *if* the thief decides to use a utility to explore the FS, then it _might_ cause a problem with your Starbucks credit.

Is it a good practice when the SDK supports secure storage? Of course not, but it’s not catastrophic.

But, honestly the big draw to Starbucks coffee over other coffee shops is not that it's a gourmet delicacy. People buy the drip because its extra caffeinated. If you need your morning caffeine bump that's the place to go. Also Starbucks has a variety of espresso drinks that most shops don't have or are not convenient. Finally, it's a comfortable (usually) place to meet for a casual cup. People like to jab Starbucks the same way they jab Apple. Sometimes its deserved, but most times its just petty, baseless & spiteful.

So true. I can understand not wanting swill, but StarBucks has some OK blends, some OK espresso drinks ... in the context of: I’m not at home, and just need a convenient cup, I’d like to chill for a moment, do a little work, maybe grab a breakfast sandwich.

I’m assuming all the fancy coffee folks in here only buy raw beans, home roast 'em, grind with at a bare minimum a Baratza and use a Aeropress ...

 

[Will do good]

Lazy Starbucks

How lazy and uncaring is Starbucks and their IT team?

We should send these company a strong message by not buying their products.

 

[randallking]

As the article on AppleInsider states, a crash reporting analytics firm named Crashlytics is responsible for the log file. Now, Starbucks is still ultimately responsible this, but the source of the poor programming is apparently Crashlytics, right?

 

[Iconoclysm]

Do hipsters still hang out at Starbucks? I thought it would be regular Joe Schmuck-people.

The "real" hipsters would most likely be sitting barefoot, scratching their 17th century style ironic beard, listening to obscure music from obscure artists no-one has heard of (not heard due to pure musical reasons) with their new iPad Air, writing a intricate self biography/action cross-over drinking Blue Mountaindrip coffee or espresso macchiato in the closest place that has a trendy tatooed hipster barista?

People who are truly serious about espresso just roast the beans and make it at home, no barista can compete with that.

 

[Rigby]

I have a complex passcode set because I'm afraid of this sort of thing. Does that encrypt all the data, or is that just used for the keychain?

A device passcode doesn't help in this case, since reportedly the password is stored neither in the keychain, nor is iOS data protection used for the application data.

I'd recommend to remove the app until they have fixed this. If you want to continue using the phone to pay at Starbucks, you can send your card to Passbook before deleting the app. Paying via Passbook works just as well as using the Starbucks app.

 

[coolfactor]

I'm very surprised to read all of the anti-Starbucks comments in this thread. Here in Canada, Starbucks is known as the second-best place to get a good coffee, after the now-more-popular Tim Hortons. Starbucks is known for its expensive prices, but quality product.

----------

I'm not surprised that their app is poorly designed. That's all-too-common these days when every company big and small claiming to be able to create iOS apps, and company executives selling out to the promise of $$ in their eyes. What is overlooked is the quality of the app being created. It's simply bandwagon mentality. My bank suffers from this, and I'm very frustrated with them over it. Their mobile app is terrible.