Partner With Us Auto Insurance Quote Domain registration Online Education Hurricane Shutters Free Business Cards Web Hosting Directory KVM Switches Server Racks Online Shopping Phone Cards Memory GPS Televisions Promotional Pens

Two days after E*TRADE claimed it had sealed a security hole that had pointed out to them a month previously, a watch dog said users' safety is still compromised.

It was made known to the public last Friday that one Jeffrey Baker, a software developer who has discovered several JavaScript-related security holes on the Net, found flaws in E*TRADE's system that enable third parties to recover user names and plain-text passwords of any user.

The popular, but often embattled broker, said Sunday it had changed its encryption technology, effectively gluing the loophole shut. But Weld Pond, manager of research and development for Internet security consulting firm @Stake, said even though the company has fixed the hole Baker found, it shows other signs of poor security design, such as six-character limit on passwords. This makes accounts susceptible to what are called "brute force" or "dictionary" password cracking attempts.

"These are just signs that the people who are building the site aren't really experts in security and they haven't had someone come in and do an assessment of the site of the security of the site," Pond said. "So, it's always been a target and it will continue to be a target. This is just one problem that they're fixing -- there are many different problems that Web applications can have so if it has this problem, I would say there is a good chance that it has other problems."

Chief Strategy Officer for Netreo Inc., James Mancini, Tuesday agreed, with Pond's assessment. He said a standard formula for password cracking shows that E*TRADE's six-character password limit and character set does not pass muster for the amount of security needed.

"If you took that same password and just made it eight characters long it would take an average of 50 years to crack the password and a maximum of 101 years to crack the password just by adding 2 extra characters because you increase the potential entropy of the system by that much more," Mancini said. "So by limiting it to six characters and limiting the character set, they're creating an environment where it's practically very possible to brute force the passwords."

E*TRADE did not return calls Tuesday afternoon.

This latest loophole appears to have been caused by the way in which E*TRADE encrypts and stores passwords on users' PCs using a cookie mechanism. By using a "cross-site scripting attack," an attacker could create a Web link allowing access to the cookie and the passwords it contains if an E*TRADE customer were to click on that link.

"If someone wanted to take advantage of the security hole, they would be able to trade securities or transfer money away from E*TRADE accounts or purchase securities in someone else's name," Baker told InternetNews Radio this week. "I understand this is insured against, but it certainly is a serious problem if your only business is trading securities.

Baker had notified E*TRADE of the hole in mid-August, but the firm did not bear down on and command closure until a couple days after news of the flaw was made public on BugTraq.

E*TRADE was besieged by a series of attacks by hackers earlier this year, although no customer accounts were compromised.