Security hole on O2 website

Anonymous · ‎21-01-2011

I didn't want to have to post this publicly, but customer services have ignored me (and hung up twice), and my emails are unanswered.
So
There is a nasty security bug on the 02 website. I changed my password via the lost password link and found my new username and password in the clear in my browsers history. Anyone using that browser can therefore see my credentials and use them to log into the site.
Hey O2 - Please get in touch so I can tell you about this and you can fix it.
Thanks

Anonymous · ‎21-01-2011

There is just other users here, no o2 participation!

Abs · ‎24-01-2011

Hi dmcg123,
I've tried to replicate the issue but didn't discover any user credentials in the browser history or in the URL. Could you please check this one again from your side and if required we can get our technical engineers to investigate this for you.
Thanks
Abs

Anonymous · ‎24-01-2011

Still there - steps to replicate (at least in Firefox Mac)
Steps removed
Thanks

Anonymous · ‎24-01-2011

I can't replicate this. Which browser are you using?

Anonymous · ‎24-01-2011

Still there - steps to replicate (at least in Firefox Mac)

Anonymous · ‎24-01-2011

Anonymous · ‎24-01-2011

Also applies to Chrome. Hard to believe that it only happens on Mac, but not tested on Windows.

Abs · ‎25-01-2011

Thanks for the screen-shot dmcg123,
I'll try to replicate the issue on a mac (with safari, FireFox browser) as it doesn't seems to affect windows based OS.
Abs

Anonymous · ‎25-01-2011

I don't think that you're trying hard enough - it's there in the browser history on Firefox 3.6.13 on Windows XP
Can we take this discussion to email please.
D