TenthOfMarch.com

This is getting ridiculous. After all the suggestions and bugs I found in the Part One and Part Two of my reviews, and a short follow up here, the Advertlets’ team don’t seem to have learned anything at all! I wonder if they ever will.

So, they have done some changes to their system AFTER reading my reviews. To summarize the whole story, those bugs I found shouldn’t even be there in the first place. Proper testing of the system would have ensured those bugs were found and fixed BEFORE their system was launched. Having bugs like that after over 300 people have registered an account with them could be very dangerous. That proves that they did not conduct a proper test on their system before it was launched.

I don’t believe that they have learned their lesson because if they did, I wouldn’t have found another bug in their system. This is not some MAJOR bug but it does prove that they did not conduct a proper test before releasing their new updates.

They provided a new option in their publisher’s admin area called, “Change Your Password“. As the name suggests, you may use it to change your password (which I highly recommend you to do). The funny thing is that they enforce a minimum 6 characters password during registration but do not enforce the same rule when a user changes their password. I tried changing my 10 characters password to a 1 character password, and it was accepted.

*sigh* I am your user, not your beta alpha unit tester, ok?

Stumble it!   Share it!   Subscribe to my feed

In the first part of my review on Advertlets, I used the words lazy, amateurish and shoddy work to describe the design, bugs and quality of work that I found in their system. I was challenged to it but it was answered by these comments (here, here and here).

I received an explanation from Firdauz (from Advertlets) which was supposed to ‘cover-up’ all the laziness, amateurish, shoddy work and maybe even possible password vulnerability that I found.

What’s assumed as laziness and amateurish was in fact; our best decision at that particular time.

Even up till this point in time, they have never stated that the users’ passwords in their system IS ENCRYPTED. They mentioned how their system was capable of warding off “SQL injection, brute force attacks, URL guessing, and social engineering” and that their system is “indeed secure, and we can vouch for the protection of your data and password“.

However, the question to be answered is, “Are the users’ passwords encrypted?” It doesn’t matter if their system is 100% “unhackable” from the outside, encrypting the users’ passwords are considered the fundamental practice in developing a system. The users’ passwords should NEVER be stored in plain text no matter how secure a system may seem to be — that’s the standard principle.

mooiness gave his point of view:

But you don’t let loose an application which fails one of the most basic principles, ie. password security.

You(r) best decision at the time should not have been this. To me, it sounded like you guys rushed it out the door so that you got something to show.

No - your best decision at the time should have been to put yourselves in the shoes of a user and whack the system as hard as you can.

One point that I missed out in my review is that they neglected one of the basic password security feature — setting a minimum password length. According to this and this, the minimum length of a password must be at least 6 or 7 characters to be considered as standard. Shorter passwords are considered WEAK and are more vulnerable.

However, I have tested and their system allows passwords as short as ONE character. I have one account’s password which is “a” and another account’s password which is “abc“. Let’s hope they did not neglect the most important security feature — encrypting the passwords.

If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization.
(Weinberg’s Second Law)

What do you think?

Stumble it!   Share it!   Subscribe to my feed