QR code danger

vigman

Hi

I have received my new Orange router (although My Account has no details of my change to BB + line rental etc).

On the outside of the unwrapped box is a QR code.

It has ALL my details on, including passwords!! Whose clever idea was that!?

Vigman

bod1467

The could possibly be a breach of the Data Protection Act.

MothballsWallet

I would start by calling Orange and asking them why they use a QR code to carry this information which can then be read by anyone with a smartphone and a QR code reader app.

Then come back here and post what they tell you.

vigman

bod1467 wrote: »

The could possibly be a breach of the Data Protection Act.

You are quite right!

With my retired and 'not very well' hat on, I did not think of that. Embarrassing as formally as an IT Manager I had to make sure that even discarded student printouts were shredded if they only had their name and/or number on because of DP and was warned that I was personally responsible for any breach, not the university I worked for!

Vigman

vigman

MothballsWallet wrote: »

I would start by calling Orange and asking them why they use a QR code to carry this information which can then be read by anyone with a smartphone and a QR code reader app.

Then come back here and post what they tell you.

...please!

I will write a formal complaint and come back here with their written reply!

Vigman

vigman

Sent to Orange CS complaints in a letter with a photo of the (obscured!) QR code on external packing:

Details of your complaint:

Apart from not putting my request for home phone through on first request and that I find my ‘new’ Brightbox router package does not include the UK three pin power adapter (have emailed about these), I have a very serious complaint:

On the outside of the mailed router package is a plainly visible QR code. Reading this with my iPhone, it gives ALL my user details and passwords! (See enclosed photo with QR obscured by me for obvious reasons)

As an IT professional, I believe that this is illegal and against the Data Protection Act, and is certainly a very serious breach of security for a major communication company.


Your resolution requirements:

1.) I should really refer this to a solicitor as it is a serious legal matter, however, I am open to offers of compensation in the first instance.

2.) From now on all packages should be completely covered for posting eg in a black plastic envelope and NO QR codes must be visible to any member of the public including Orange/EE staff.

I look forward to your reply with interest

Vigman

bod1467

1.) You have just shot yourself in the foot, trying to monetize their (potentially) illegal action. In short you are saying "bribe me to keep quiet" (which is pointless as you have already blabbed about it here!)

espresso

vigman wrote: »

Sent to Orange CS complaints in a letter with a photo of the (obscured!) QR code on external packing:

Details of your complaint:

Apart from not putting my request for home phone through on first request and that I find my ‘new’ Brightbox router package does not include the UK three pin power adapter (have emailed about these), I have a very serious complaint:

On the outside of the mailed router package is a plainly visible QR code. Reading this with my iPhone, it gives ALL my user details and passwords! (See enclosed photo with QR obscured by me for obvious reasons)

As an IT professional, I believe that this is illegal and against the Data Protection Act, and is certainly a very serious breach of security for a major communication company.


Your resolution requirements:

1.) I should really refer this to a solicitor as it is a serious legal matter, however, I am open to offers of compensation in the first instance.

2.) From now on all packages should be completely covered for posting eg in a black plastic envelope and NO QR codes must be visible to any member of the public including Orange/EE staff.

I look forward to your reply with interest

Vigman

I'm sure that Orange will have a good laugh at your letter telling them what their "resolution requirements" are and as for compensation, dream on!

What use is this information to anyone other than yourself?

The first thing that you should do is change the passwords yourself and an "IT Manager" would know that wouldn't they?

I also look forward to seeing their reply but mountains and molehills come to mind.

:rotfl:

bod1467

The point about the QR code is a valid one ... depending on what details are contained this could be a serious breach of the DPA.

But seeking compensation (for what exactly?) negates the claim and means it won't likely be treated seriously.

MothballsWallet

vigman wrote: »

...please!

I will write a formal complaint and come back here with their written reply!

Vigman

Sorry, I should have added "please" - just forgot, that's what happens when you get to my age

espresso