The call went out: November 2010 was going to be the 300th issue of PC Plus. Our articles had to be better than ever before and preferably some kind of top N list to go along with the issue’s theme (the lead article for example was 300 Advanced PC Tips).

So, my top 10 algorithms? Data structures? A possibility, but I wouldn’t have much room to say anything in depth about each (“Number 4: Quicksort. It’s very fast at sorting but a bit complicated to get right. Number 5: Red-black trees. A very fast search structure but nearly impossible to get right.”). After some thought I finally decided on listing my top 10 programming mistakes. I’d been doing a series of “Messages from the CTO” for the DevExpress newsletter and some of these top 10 items came up during my writing those for work. Hey, I’m all for recycling!

As it happened, this particular article turned out to be the most popular I’d ever written for PC Plus. It got published online by techradar.com, with more comments than I ‘d seen before for one of my articles posted there. I got mail about it. I seem to remember it got picked up by the Code Project newsletter as well. All in all, quite a good one.

This article first appeared in issue 300, November 2010.

You can read the PDF here.

(I write a monthly column for PCPlus, a computer news-views-n-reviews magazine in the UK (actually there are 13 issues a year — there's an Xmas issue as well — so it's a bit more than monthly). The column is called Theory Workshop and appears in the Make It section of the magazine. When I signed up, my editor and the magazine were gracious enough to allow me to reprint the articles here after say a year or so.)

I finally got round to reading the Christmas edition of PC Plus this evening and was pleasantly surprised to see that someone had written in about a recent article of mine: 10 mistakes every programmer makes. It’s going to be next year before I republish it here in this hallowed blog, but you can read it over at TechRadar.com right now.

I must admit this one was hard to get going. My esteemed editor at PC Plus (Alex Cox), sent me an email in July basically saying that for the 300th issue they were going to be writing a whole bunch of top X lists (the main article was 300 Advanced PC Tips) and could I write an article on the top 10 errors developers tend to make. Problem is, it would have been cheesy to have written it about C# or JavaScript (my current languages) or Delphi (my previous language), so I had to try and make it applicable over everything and still make it readable and thought-provoking.

Anyway, I wrote it, it was published and Cecil Wallis sent an email to PC Plus saying:

Your article on mistakes every programmer makes interested me greatly because you haven’t — as far as I remember — discussed programming techniques previously. First, a minor quibble: if I walked away from sites that “promise to email you your original password”, I would never be able to buy anything online at all. Maybe there should be a distinction between convenience passwords and valuable passwords.

Alex responded:

I found Julian Bucknall’s article about programmers’ mistakes fascinating. The part you’re referring to discussed storing sensitive data in plain text. I think we can both agree that it would be a poor show if a company stored a database of its customers’ logon and passwords in unencrypted form. That was the thrust of Julian’s argument. I agree with Julian though — if a business sends out plain text passwords via email, it gives a bad impression of its internal security [policies] and attitudes. Better firms will suggest creating a new password, or possibly email out pre-agreed clues and reminders hinting at your old access code.

My bank unsurprisingly, doesn’t mess about. If I forget my password (which I do often), I have to answer a lots of security questions, then it posts a new code to my home address.

It’s also worth remembering that even if a hacker gets your password and logon details, they’ll most likely need your credit card information before they can order anything online. Most shops require your card identifier number (the three- or four-digit code on the back) before they’ll process your order.

You can further protect yourself by registering only credit card details with online shops. The Consumer Credit Act (1974) makes the card company liable for losses through fraud if you’ve acted sensibly. Register a debit card online and criminals will be able to take your cash straight from your account.

All that said, Julian’s point stands in my opinion. If a company emails out plain text passwords, move on. There are lots of online businesses out there, many of which take security very seriously.

Of course, what happened in between Alex writing his reply and now was that someone well and truly hacked Gawker Media, and, even though their passwords were encrypted, they were soon cracked. (Gawker used DES, which is “easily” amenable to a brute force attack, so the passwords were equivalent to being stored as plain text.) The issue is not that, boom, your or my password to Gawker was then in the hands of the bad guys (hey, hacker, write a comment for me would you?) but that a remarkable number of people use the same passwords across many sites. Sure, Amazon may be ultra secure, but if I use the same password (my email address as user ID is easy to determine) for Bacon Cooks Online which doesn’t give a damn about security, then the bad guys have access to my Amazon identity (and from there might start buying stuff, expensive electronics stuff that’s easily sellable).

So by all means, have two passwords (don’t-give-a-damn and secure) in your life but I’d be scared nevertheless. My banking and PayPal passwords are different and I change them regularly. I buy things from Amazon regularly and that has a different password too. My eBay password is different from my PayPal password, and so on, so forth.

As Alex says, I’m bloody glad that my bank plays really hard-nosed when I forget a password; I wouldn’t have it any other way. But then again I bought and use a password database program and don’t have to remember any passwords at all. All my passwords are different across every site and for every function. I wouldn’t be able to order stuff online if I didn’t have access to my database.

Anyway I stand by my thesis: if a website posts you your original password when you report to them that you’ve forgotten it then be very very careful.