Hacker News Reader

Comment by ianbicking | Hacker News Reader

"No, Panera Bread Doesn’t Take Security Seriously"

I didn't expect this to be an actual description of a security event, but just a rhetorical observation: of course Panera Bread doesn't take security seriously. There's no "security" in the name of their company. They are not in the security business. I think they do actually take bread seriously. And store location, and customer service, and stuff like that, because that's the kind of business they are.

Because of PCI you can expect they probably do handle your credit card (except apparently the last 4) reasonably well. Because of other regulations you can expect they take food safety seriously. They take basic business operations seriously because there's a bunch of professional business-runners, and they know they really have to.

View on HN

This might clarify the title for you: https://www.troyhunt.com/we-take-security-seriously-otherwis...

The title is intended to be a play on the most common response companies make when they experience a serious security failure: "We take security very seriously."

We should start a blog called We Take Security Seriously that links to these responses, just like Our Incredible Journey[1] for acquisition announcements.

__________

1. https://ourincrediblejourney.tumblr.com/

The title is a retort to a statement they made about "we take data security very seriously" while lying about solving the problem.

I'm no expert, but PCI requires that companies protect stored cardholder data, which includes cardholder names. They have badly failed to do so, so they don't appear to be PCI compliant.

This is actually an interesting case from a PCI perspective. PCI doesn't protect last 4 of a credit card number or names individually, as you wouldn't be able to link name to card number if stored separately. Name is only 'cardholder data' when stored with a full cc number. In this case both name and last 4 are stored and revealed together, but I still don't think that constitutes PCI protected information according to their definition of cardholder data. My initial interpretation is that they wouldn't be in breach of PCI from just the information we have publically available about this issue.

It would appear that they have a very serious systemic security problem in their organization. Their "Director of Information Security" is obviously very very incompetent, there wasn't any real resolution after many months even though they claimed it was fixed. There's no way that a single person or even just a handful of managers could be solely to blame for this.

If this is how they respond to security issues I think it's a fair bet that they're making the same mistakes that e.g. Target and Home Depot did. Who's to say a VPN connection for some lowest bidder third party vendor hasn't already been used to exfiltrate tons of credit card details?

> Because of PCI you can expect they probably do

We can't expect that because they didn't. Rules and best practices do not magically get followed because they exist, and in this case they definitely did not take security (of their customer data) seriously at all.

Exactly right. What do they know about it? They have an expensive firewall, and SSL on their website, they think they are covered.

Companies like this would be better off not on the internet at all. It's not like anyone needs to visit the website to know where the nearest Panera Bread is. Google will tell you, if you don't know.

Are you suggesting that security should be regulated like payment cards and food safety? Because I'm on board.

> I think they do actually take bread seriously.

No they don't. They admit on record using same additives as Subway mostly a rubber-type chemicals invented by BASF that make bread more elastic, won't go dry this quick and has longer shell-life. Basically when you eat their bread some ingredients are the same of the tires your car was put on!

Further good read how horrible quality their food is:

https://www.thealternativedaily.com/panera-bread-additives/

You can't be serious about that link. It is a quack website that claims that wheat and sugar are harmful additives! It also uses the number of ingredients as a good metric of the healthiness of food.

That's not how ingredients work. This is like saying all "chemicals" are bad, when that would also include water.

Seems like those chemicals are total reagents...they react and are not left over.

Reply on news.ycombinator.com