Yahoo-owned Tumblr has pushed out a fix for its iOS app, after claims it was not using encryption to keep users’ passwords safe.
Tumblr issued an update yesterday, urging all users to change their passwords as a precaution. “We have just released a very important security update for our iPhone and iPad apps addressing an issue that allowed passwords to be compromised in certain circumstances,” the blogging company said in a blog post, revealing little else.
It did hint that secure sockets layer (SSL) was not implemented properly, by saying passwords could be “sniffed in transit on certain versions of the app”.
A reader of The Register claimed the iOS apps was not logging users in over an SSL server, meaning plain text passwords were being sent between phones and servers. Hackers sitting on the same network could easily intercept such passwords and compromise a Tumblr account, and any other site using similar login credentials.
The threat becomes considerably more severe where the Tumblr user is on an unprotected Wi-Fi network.
It appears the app uses SSL after login, but not before – a serious security failure in many professionals’ eyes.
Many Internet services do SSL badly, as TechWeekEurope discovered last year in an investigation into security on university websites.
What do you know about Internet security? Find out with our quiz!
American space agency prepares for testing of Boeing's Starliner, to ensure it has two space…
As UK and Europe develop closer military ties, European Commission says it will invest €1.3…
Zuckerberg seeks to revive Facebook's original spirit, as Meta launches Facebook Friends tab, so users…
Notable development for Meta, after appeal against 2021 WhatsApp privacy fine is backed by advisor…
First sign of shake-up under new CEO Lip-Bu Tan? Three Intel board members confirm they…
Trump's nominee for SEC Chairman, Paul Atkins, has pledged a “rational, coherent, and principled approach”…
View Comments
Great article, this is a surprising security oversight by Tumblr, since this type of security measure is not difficult to implement.
For users interested in protecting themselves. We have written out some steps you can take to protect your data from this type of flaw.
http://www.doctrackr.com/blog/bid/318540/Is-Your-Social-Media-Secure-Privacy-Tips-from-Tumblr-s-Failure