American Express may have failed to encrypt data

American Express may be in hot water after a computer engineer discovered a portion of the card brand's website, which claims to be secure, is sending private information in the clear.

Joe Damato wrote in a blog post Tuesday that he received a promotional email from American Express encouraging him to sign up for the Daily Wish service, through which cardholders can receive hefty discounts on a limited amount of merchandise, such as computers and camcorders.

If users click on the "Sign up for Daily Wish" button, they are prompted to enter personal information, such as name, card number, security code, expiration date and billing zip code, into a pop-up box. The box includes a "This page is secure" notification link, but upon further review, Damato found this not to be the case.

The domain for the sign-up box was not using "https," an encrypted form of information transfer, he said. Damato used the open-source packet analyser Wireshark to confirm that the (fake) information he entered into the form was delivered in clear text back to American Express' server.

The card company, in a tweet posted yesterday, said it was aware of the issue and investigating.

See original article on scmagazineus.com