Books. And Insecurity.

Five minutes worth of research has Amazon in the lead for book pricing after reviewing Google shopping results and the official course materials provider.  Good enough for me. The actual check-out process ended up revealing those subtle differences between what I was buying through my own channels and the official university authorized book store, however. It was the add-in stuff, an “access card” and a subscription to MathXL online. The latter appears to be used for assignments and other very mandatory activities. I’m a bit more sceptical regarding the usefulness of the access code to supplement the book materials, but I figured better safe than sorry.

In the end I’ve save a whopping $40 (12%) and it took about an hour for me to be confident I found all the correct items. But, the loose-leaf version of text wasn’t available at the official bookstore, nor the Kindle version of the book, and these should help me get an extra hour of work in during the morning commute without lugging books around. Maybe next time I’ll be a bit quicker finding everything I need.

In checking out the MathXL site, I’ve discovered a big pet peeve of mine. They sent my permanent account password to me via email. Their web page appears to send login info in the clear also. Their privacy policy says they can share your personal identifying information with Pearson Education and include your password and credit card information as “personal identifying” information. This is just basic stuff that can be accomplished with secure methods without reducing any functionality or experience of them or me. It turns out that they are not alone, apparently a lot of major web sites have issues. I’m not sure how major this company is, but I imagine a lot of people use the same password as for other school information, since it feels like an extension of class. I tend to keep several levels of passwords, not just one for everyone but not different ones for everyone either. Like one junk password for accounts without anything important up to very secure bank-account-type passwords. I used a medium-low importance password for these guys just assuming they would have basic security practices since they are associated with a class and had to go change my password at a few other places after the fact. Boo MathXL and boo Pearson Education.

This entry was posted in Random. Bookmark the permalink.

1 Response to Books. And Insecurity.

  1. -j says:

    An update, already! Alvin at Pearson Education Customer Technical Support gets points for promptness. The content of the response however…

    Here is the gist – they get a fraction of a point for saying that they are updating their processes. But negative one point for no real commitment to change within any time frame. Negative two points for saying that this is “industry standard for non-financial applications”. While information containing payment cards or bank accounts is especially sensitive, they seem to miss the point. Damage can be done apart from payment card information. Name, address contact phone number can be powerful elements of an identity. And, if I use this password for a class or other important but non-financial web pages, this obviously leads to problems ranging from annoyances to actual identity issues.

    My main beef is that this is just laziness, they should change already.

    The response in detail:

    Pearson must strike a reasonable balance between support methods that are accessible to all users, and the risk of unauthorized access to information in our learning applications. Allowing customers to retrieve passwords via email is an industry standard for non-financial applications.

    In response to the changing landscape, we are developing new user rights management protocols as part of a broader commitment to tighten security and safeguard customer accounts, information, and product access. Passwords will no longer be retrievable; customers will be able to reset passwords through secure processes.

    In the interim, we have posted notice on the Forgot Login retrieval page stating that the password will be sent in plain text. The forgot login email recommends that users change their account password upon receipt of the email. The password creation help documentation also recommends against using the same account credentials as in place on banking and other financial accounts.

Leave a comment