Yahoo-owned Tumblr has pushed out a fix for its iOS app, after claims it was not using encryption to keep users’ passwords safe.
Tumblr issued an update yesterday, urging all users to change their passwords as a precaution. “We have just released a very important security update for our iPhone and iPad apps addressing an issue that allowed passwords to be compromised in certain circumstances,” the blogging company said in a blog post, revealing little else.
It did hint that secure sockets layer (SSL) was not implemented properly, by saying passwords could be “sniffed in transit on certain versions of the app”.
A reader of The Register claimed the iOS apps was not logging users in over an SSL server, meaning plain text passwords were being sent between phones and servers. Hackers sitting on the same network could easily intercept such passwords and compromise a Tumblr account, and any other site using similar login credentials.
The threat becomes considerably more severe where the Tumblr user is on an unprotected Wi-Fi network.
It appears the app uses SSL after login, but not before – a serious security failure in many professionals’ eyes.
Many Internet services do SSL badly, as TechWeekEurope discovered last year in an investigation into security on university websites.
What do you know about Internet security? Find out with our quiz!
Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…
Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…
Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…
Welcome to Silicon In Focus Podcast: Tech in 2025! Join Steven Webb, UK Chief Technology…
European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…
San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…
View Comments
Great article, this is a surprising security oversight by Tumblr, since this type of security measure is not difficult to implement.
For users interested in protecting themselves. We have written out some steps you can take to protect your data from this type of flaw.
http://www.doctrackr.com/blog/bid/318540/Is-Your-Social-Media-Secure-Privacy-Tips-from-Tumblr-s-Failure