BYOD Security: Starbucks Mobile App Saves Passwords In Clear Text.

What is the one thing we’ve learned about data security in the past three years?  There’s been a lot of things (such as, smartphone encryption is a good thing.  Same goes for laptops), but I’d say the one definitive thing is this: you do not store passwords as clear text.


So, it’s mighty surprising to find that one of the most beloved apps in the US is doing exactly that.  The app in question?  The ubiquitous Starbucks mobile app.

Convenience v. Security

According to, a security researcher found that the Starbuck app stored usernames, email addresses, and passwords in clear text within a smartphone.  The decision to do so, it is presumed, was due to convenience:

The issue appears to be an example of convenience trumping security. One of the reasons for the Starbucks mobile app’s popularity is its extreme ease of use. Customers need only enter their password once when activating the payment portion of the app and then use the app to make unlimited purchases without having to key in the password or username again. (Only when adding money to the app is the password required.)

Starbucks could have chosen not to store the password on the phone, but users would then be forced to key in their username and password every time they wanted to use the app to make a purchase.

As a person working in the security arena, this is scandalous.  But, as a consumer of coffee – mermaid-branded or otherwise – I can see how typing in a password each time you want to drink coffee would be a hassle and then some.

Plus, think about credit cards: they don’t exactly come with passwords on them.  The numbers are on the face for everyone to see.  So, one almost feels like Starbucks can be excused for choosing convenience over security.

Almost.  Because there are significant differences.  First, the Starbucks app does come with an email address and a password.  If you lose a Yahoo! branded credit card, the thief won’t be able to break into your email account.  The same is not true for the Starbucks app.

Second, a credit card comes with fraud protection, limiting losses if a thief decides to start using your card.  I’m pretty certain that this is not true of the Starbucks app.  If someone decides to clear out your Starbucks account by going on a coffee binge, you’re losing 100% of that money.  Furthermore, losses could be even greater if the auto-replenish option is turned on, as the article goes to point out.

Give the People a Choice

So, it sounds like Starbucks was caught between a rock and a hard place.  On the one hand, there are security concerns, which are important.  On the other, the app wouldn’t have been as successful if the company made it “hard to open up the wallet,” if you will.

What to do?  It seems to me that the answer is quite simple and staring them in the face: give the people a choice.  (And Starbucks knows choice.  This is a company whose coffee offerings reach 87,000 different combinations.)

Those who don’t want to bother with the extra security can use the Starbucks app like they’ve always done, knowing that they’re at risk.  Those who don’t mind punching the virtual keyboard a bit and prefer the extra security (and peace of mind) get their way, too.

Of course, implementing a two-prong approach would make things more complex, but Starbucks has a $56 billion market cap.  They can afford an engineer or two who can make this a reality.

Related Articles and Sites:

Comments (0)

Let us know what you think