The FSFE justly drew the line at providing private information of supporters. How many other customers of Nexi simply handed over such data 'because audit'?
As an Italian living in another EU country, I always thought that the amount of (broken) bureaucracy of Italy was not particularly worse. However this story comes after a couple more I heard this week, in a line of absurd practice possibly due to absurd regulations.
> Over the past few months, our former payment provider Nexi S.p.A. (“Nexi”) requested access to private data, which we understood to be specifically the usernames and passwords of our supporters.
I must be missing something, but why is there an expectation that clear text passwords would even be known?
We work with MLS provider(s) that requires us to keep plaintext password for our users and provide it on request in case of `breach in the security of MLS Listing Information or a violation of MLS Rules`.
The user is accessing only copy of their data in _our_ systems, the user has no contact with MLS itself directly or indirectly.
Sounds like someone is being "overenthusiastic" about interpreting the KYC/ALM regulations.
Combined with the FSFE not being your "usual" charitable or business organization so setting off auditor red flags and perhaps raising the risk profile of Nexi as a payment processor.
Just a follow up: I wrote nexi germany via some contact form, that I will avoid using their services because of that story. They called me back and told me, that they asked the fsfe for a test account only. They also made an internal investigation, if someone asked for passwords of real accounts, which is a clear no-go for them.
12 comments
[ 2.6 ms ] story [ 31.1 ms ] threadI must be missing something, but why is there an expectation that clear text passwords would even be known?
[1] https://serverfault.com/questions/293217/our-security-audito...
The user is accessing only copy of their data in _our_ systems, the user has no contact with MLS itself directly or indirectly.
Combined with the FSFE not being your "usual" charitable or business organization so setting off auditor red flags and perhaps raising the risk profile of Nexi as a payment processor.