GMBill.com CEO Responds to 'Plaintext Passwords' Tweet

SAN FRANCISCO — A tweet by an adult industry journalist spread like wildfire last week, bringing mild hysteria to message boards.

The tweet made by Violet Blue said: “One of the top adult affiliate credit card processing payout companies is storing passwords in plaintext.”

On Saturday, Blue confided to XBIZ that the top affiliate processor discussed in the tweet was GMBill.com.

“All the passwords are stored in plaintext on the server and in user accounts,” she said.

Blue went on to discuss another concern: “They only do payouts via wire transfer/EFT, and so that means everyone's bank account credentials are 99 percent likely to be stored in plaintext on the server too.”

“One not-terribly-clever hacker could do a lot of damage with tools readily available online,” she emphasized to XBIZ.

Sunday morning, GMBill’s CEO and founder, Garion Hall — also CEO and founder of AbbyWinters.com — responded to Blue’s tweet over visible plaintext passwords.

“[Blue] is incorrect,” Hall told XBIZ. “All passwords are stored encrypted but are decrypted when the user logs in — for example, once a user successfully authenticates and logs in, their password is decrypted.” Hall continued saying that the process “is widely considered an effective security practice.

“GMBill.com acknowledges the practice of showing users their passwords on-screen is falling out of favor — due to the risk of ‘shoulder surfing’ or a malicious user accessing browser cache), but is still common practice,” he said.

Hall noted he could come up with numerous examples over this but pointed to iCloud as one.

“For example, Apple’s Keychain also shows users passwords of sites and networks they have access to, after entering their admin password,” he said. “This is considered low risk, as at most it affects a single user.”  

Hall also addressed Blue’s accusation that affiliate’s EFT, or wire, bank account details are at risk.

“These are the same details every company places on invoices and some websites to customers,” Hall said. “Access is secured through standard security practices; by taint checking of all database inputs, all code being encrypted — including database access credentials — and fine-grained privilege separation for database user accounts.

“However, we have taken these accusations as a reminder that security never sleeps,” he said. “We have added velocity controls to the affiliate login process, blanked previously visible passwords, and even-more-thoroughly encrypted affiliate bank details. These changes will be released to production servers as a priority.”

Hall emphasized to XBIZ that there was no breach at GMBill; he also said he invites concerned parties to direct specific questions to him at garion@gmbill.com.

“GMBill.com conducts regular log scans to identify suspicious activity and has undertaken an especially close look in light of these accusations. We confirm there has been no breach of our security systems, no affiliate, client or customer data has been accessed by unauthorized parties, and all security measures in place continue to function appropriately.”

Related:  

Copyright © 2024 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
Reproduction in whole or in part in any form or medium without express written permission is prohibited.

More News

Justices Alito, Thomas Invoke Victorian-Era Morality Law, Raising Censorship Concerns

Several national publications reported this week on widespread concern among Free Speech advocates after U.S. Supreme Court Justices Samuel Alito and Clarence Thomas repeatedly invoked during a hearing the infamous segregation-era law the Comstock Act, which was the cornerstone of U.S. censorship of sexual material from the 1870s until the 1970s.

Skinfluential Management's FansFuel Acquires Fanwire

Creator stats and affiliate marketing platform FansFuel has acquired creator account management tool Fanwire.

Nebraska AV Bill Moves Forward Despite Privacy, Free Speech Concerns

Nebraska’s unicameral Legislature has given first-round approval to LB 1092, the state’s version of the age verification bills being sponsored around the country by anti-porn religious conservative activists.

AEBN Celebrates 25th Anniversary

The Adult Entertainment Broadcast Network (AEBN) is celebrating its 25th year in business this week.

Performers in Meta Blacklisting Lawsuit Seek to Preserve Antitrust Claims

Adult Performance Artists Guild board officers Alana Evans, Kelly Pierce and Ruby have informed a California court that, although they want to drop their lawsuit claiming that Meta conspired with OnlyFans to blacklist rival premium fan platforms’ talent, they may still pursue antitrust claims in the future.

FSC, Co-Plaintiffs to Ask US Supreme Court to Review Constitutionality of Texas Age Verification Law

Free Speech Coalition (FSC) and its co-plaintiffs in the challenge to Texas’ controversial age verification law have petitioned the United States Court of Appeals for the 5th Circuit to stay its recent decision upholding the law, because they intend to appeal to the U.S. Supreme Court to review the law’s constitutionality.

FSC Vows to Fight Florida Age Verification Law

Free Speech Coalition (FSC) has issued a statement vowing to continue fighting Florida’s new age verification law, which was signed by Gov. Ron DeSantis on Monday as part of a comprehensive bill targeting minors’ use of social media.

Kansas Republican Aims to Create New Bureaucracy to 'Investigate' Porn Websites

Republican state legislators succeeded Monday in moving forward Kansas’ version of the age verification bills being sponsored around the country by anti-porn religious conservative activists, despite serious concerns raised by House Democrats about the cost of establishing a new bureaucracy tasked with investigating websites for pornographic content.

SK Intertainment Launches 'Skinfluential Management' Agency, FansFuel Joint Venture

Mr. Skin/Mr. Man parent company SK Intertainment has launched new creator agency Skinfluential Management, as well as a new joint venture with Showbizz Media's creator stats and affiliate marketing platform, FansFuel.

Industry Attorney, Free Speech Champion Clyde DeWitt Passes Away at 75

Noted industry attorney Clyde DeWitt passed away on Friday in Las Vegas at 75, according to friends and colleagues.

Show More