Quantcast StorefrontBacktalk » Blog Archive » Microsoft Caves On Bing Cashback Issue
advertisement
advertisement

Microsoft Caves On Bing Cashback Issue

Written by Fred J. Aun
July 23rd, 2009
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

A quick folo on a pair of stories we ran last week, where an attorney specializing in high-tech issues complained that a promotion on Microsoft’s new Bing search engine took his personal information but then welched on the deal by not delivering about $185 in cellphone discounts. This week, an attorney for Microsoft agreed to pay the originally promised amount.

The problem was that Mark Rasch, the former head of the U.S. Justice Department’s high-tech crimes unit, was told he didn’t qualify for the discounts only after he’d given Microsoft and AT&T his personal information during the application process. Although Rasch said that he got the money this week, what he didn’t get were any assurances that the companies would delete from their databanks the information he’d provided. “A Microsoft tech guy said, `You can delete your Microsoft Live account,’ but that doesn’t indicate what happens with my information that’s probably being shared with third parties,” Rasch said.


advertisement

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...