May 12, 2003 : Microsoft Says Security Issue Resolved

📅 May 12, 2003 - Microsoft Corporation (microsoft.com) revealed last week that a security breach in its Passport online identity service had exposed personal information such as e-mail addresses, user names and credit card information.

The company said on Thursday that it had fixed the flaw, with full functionality being restored to all its users.
The flaw stemmed from a .NET Passport feature that allows users to reset their passwords by submitting an e-mail request. In its previous configuration, this feature created a vulnerability that could have allowed an attacker to change the password independently and gain access to a targeted account by redirecting the reset e-mail to a different address.
The security breach was serious enough to have affected all 200 million Passport accounts, but according to reports by Microsoft, the numbers affected were considerably less.
In August of 2002, the Federal Trade Commission signed a consent decree with Microsoft, saying it would not make false statements about the security and privacy protections of its Passport service. Any future violations could incur fines of up to $11,000 per incident.
The latest security issue is another public relations setback for Microsoft as it continues to make a concerted effort to enhance the security and reliability of all its software products.