Subject: WI: Disclosure of password
From: Akhil P Walia <[email-masked]>
To: "Demike Reon. Camino" <[email-masked]>, Claire C <[email-masked]>, Nella Jemino <[email-masked]>, jade Cuizon <[email-masked]>, dannevy Salvador <[email-masked]>, Rizza Pearl Saure <[email-masked]>, Samir Kumar <[email-masked]>, Anshul Pannu <[email-masked]>, Sumeet Kumar <[email-masked]>, Mayank Sehgal <[email-masked]>, Maibam Basanta Singh <[email-masked]>, Raj Khandelwal <[email-masked]>, Mohammad Menuddin <[email-masked]>, Krishna Tiwari <[email-masked]>, "Amar Kumar. Chaudhary" <[email-masked]>, Ashish Sharma <ashishsha
Cc: Ruchi Johri <[email-masked]>, Subir Bikas Chakma <[email-masked]>, Gee Jay <[email-masked]>, Nyle Remo <[email-masked]>, Bernadette Ferrer <[email-masked]>, Siji George <[email-masked]>, Ankur Gupta <[email-masked]>
Date: Wed, 7 Dec 2011 00:22:31 +0530 (IST)

When you are troubleshooting with customer. Don't disclose you can see customer's password in backend. 
This is common sense. 

----- Original Message ----- 
From: Rricha Kale 
Sent: Tuesday, December 06, 2011 8:46 AM 
Subject: Serious concerns about security with user credentials. 

Hello, 

I am a watchindia customer for last few years. I have issues with watchindia.tv service almost every couple of weeks. 
Today while on call with customer service representative the representative mentioned that she is logged in with my id and password. 

This is really concerning and alarming to me. Your site is storing the customer passwords as text only for the representative to read it. It is really a serious security concern for me. 
I know you are implementing SSL while logging on the website but the fact that someone can see the passwords for me really bothers me. 
Every customer has personal information like address, credit card info stored in the login. If the database gets hacked then all this information would be out there available. 

This could lead to serious identity thefts. I would expect watchindia to know these security requirements especially when they are doing business in the US. 
As a customer I can take legal action against watchindia for such issues. 
I am going to alert the fellow watchindia subscribers so they also know about this issues. 
I am a technical person and I work in security business. Hence I know how important it is to adhere to security policies ( and having such policies at first place). 

Please have this matter addressed asap. I would like to speak to someone responsible in this matter. 

Thanks, 
~Rricha