There’s not much more to say. If you have the Starbucks app on your phone get it off of there and don’t put it back on. Starbucks has a lazy attitude towards security and it appears they aren’t going to change that anytime soon.
The Starbucks mobile app, the most used mobile-payment app in the U.S., has been storing usernames, email addresses and passwords in clear text, Starbucks executives confirmed late on Tuesday (Jan. 14). The credentials were stored in such a way that anyone with access to the phone can see the passwords and usernames by connecting the phone to a PC. No jailbreaking of the phone is necessary. And that clear text also displays an extensive list of geolocation tracking points (latitude, longitude), a treasure trove of security and privacy gems for anyone who steals the phone.
The issue appears to be an example of convenience trumping security. One of the reasons for the Starbucks mobile app’s popularity is its extreme ease of use. Customers need only enter their password once when activating the payment portion of the app and then use the app to make unlimited purchases without having to key in the password or username again. (Only when adding money to the app is the password required.)
Starbucks could have chosen not to store the password on the phone, but users would then be forced to key in their username and password every time they wanted to use the app to make a purchase.
“A company like Starbucks has to make the choice between usability to drive adoption and the potential for misuse or fraud,” said Charlie Wiggs, general manager and senior vice president for U.S. markets at mobile vendor Mozido. “Starbucks has opted to make it very convenient. They just have to make sure that their comfort doesn’t overexpose their consumers and their brand.”
“Yes, it does surprise me,” said Gartner security analyst Avivah Litan. “I would have expected more out of Starbucks. At least they should have informed consumers.”
And apparently Starbucks could have done that. Two executives — Starbucks CIO Curt Garner and Starbucks Chief Digital Officer Adam Brotman — said in a telephone interview that they have known for an unspecified period of time that the credentials were being stored in clear text. “We were aware,” Brotman said. “That was not something that was news to us.”
via Evan Schuman: Starbucks caught storing mobile passwords in clear text.