Starbucks Mobile App Wasn't Protecting Your Personal Information

In case privacy isn't enough of an issue, a security researcher has discovered that the Starbucks' mobile app leaves users' personal data vulnerable.

Daniel Wood publicly disclosed the problem after the coffee super chain reportedly failed to fix the problem, according to Apple Insider.

The Starbucks' iOS app, which is the most-used mobile payment app in the country, has been storing such personal information as usernames, emails and passwords in clear rather than encrypted text, Computer World reported.

Starbucks officials confirmed to Computer World that user information has been stored so that anyone with access to the phone can obtain usernames and passwords by hooking the device to a PC.

Wood told Computer World that he had reached out to Starbucks in November regarding the issue and only published the information publicly after getting no results.

The clear text on phones "also displays an extensive list of geolocation tracking points (latitude, longitude), a treasure trove of security and privacy gems for anyone who steals the phone," according to Computer World.

A stolen phone could also let the thief make Starbucks purchases until funding runs out--or even make unlimited purchases if the unlucky Starbucks customer had connected the app to a bank account.

Starbucks Chief Digital Officer Adam Brotman told Computer World that Starbucks executives "were aware" of the privacy issue.

Officials have been vague about measures taken to mend the security hole. Brotman told Computer World that "we have security measures in place now related to that" and "we have adequate security measures in place now." He said "usernames and passwords are safe," because Starbucks has increased security.

After the discussion, Wood found the information still readily available.

Starbucks apparently opted for convenience over security, since the mobile app is among the simplest to use. If passwords weren't stored on phones, people would have to put them in every time.

"A company like Starbucks has to make the choice between usability to drive adoption and the potential for misuse or fraud," said Charlie Wiggs, general manager and senior vice president for U.S. markets at mobile vendor Mozido. "Starbucks has opted to make it very convenient. They just have to make sure that their comfort doesn't overexpose their consumers and their brand."