Orca - data leak or just incompetent?

"Meghan" is a lovely name though . I'm assuming just a little mistake.  I consider myself a fairly competent web master (non-commercial sites that are nothing to do with P2P lending) but did inadvertently make similar error one time.  I have found Orca to be extremely responsive to feedback on a couple of minor technical issues with the web site when it launched the investment option and put it down to teething problems.

More interested to know if the £100 bonus mentioned in the email is only for new investors putting in £1000 or for existing investors topping up as well. Didn't seem too clear. I've emailed them to ask.

Hello

Yes, they got back to me very quickly, saying it was an error (so 'incompetence')

Still astonished someone can be issued a personal invitation, using the wrong name. Very sloppy.

Must be a bit of forehead slapping going on, as to be fair both CEO and co-founder e-mailed me since I pulled them up on it.

Might actually invest too!

Hmmm! is that the only mistake.

I just tried searching for Orca and without adding "p2p" to it I got nothing like "Only one Orca"! in fact all I got was whales. I tried adding "Finance" to the search item and again got nothing of any use. It was lucky I know what I am expecting from the ORCA screens even though I've not been to the new P2P offering yet.

I got their finally with "orca p2p" top entry. On the page I eventually got it clearly states "only one orca" but to be honest if that were the case then why don't I get get the orca i'm looking for. Perhaps there is only one Zopa as that works but to be fair it has been around a few years I guess.

I know I'm splitting hairs here but for me advertising oneself as the only one orca is a bit risky if you are not the only one and then if it takes the last entry on the second page of orca as well am I going to go there if I was not tempted from here.  

Sorry to pick up on this but its not very helpful if it hard to find least of all for you guys at orca whose jobs may rely on this being successful.

Nice website though when I got there ;-)

Hi, I'm the lead developer at Orca. We are neither incompetent nor leaking data.

In the initial email sent out, we used Meghan's name in testing (Meghan is an employee of Orca), and simply forgot to swap that out for the customers name when sending out the email. My fault!

Secondly, to increase security, we used a different (better, and more secure) authentication system for our investments product. This was important as we are now handling more sensitive data. The reason you cannot login with your old Orca Analytics details is because we don't have access to your old passwords (for security) and so were unable to migrate accounts across.

We take our customers security very seriously. Feel free to ask if any further questions.

Thanks for the post.

John is correct, we wanted to improve the security of the login when investors sign up to the Orca investment product, hence the old credentials are not working on the new authentication system. I agree that a simple email sent to our users could have resolved any confusion. 

The good news is that we took the majority of the Zopa analysis and placed it on the front facing website so no login required. Generally we update the analysis on a monthly basis when a loan book is released. Zopa, however were late with their update so the data is good from the 1st of Feb. We've chased Zopa and will update once the new raw data is available. 

www.orcamoney.com/analytics/zopa

Be cautious of businesses that uses the vague reason "for security", without any valid explanation!

A business shouldn't have access to user's original unencrypted passwords, however, this shouldn't prevent account migration!

If password storage is done correctly, then secure one-way password "hashes" would be stored (rather than unencrypted passwords in plain text). These one-way "hashes" can easily be migrated across - no access to original passwords themselves are needed in order to migrate password hashes.

Even if the hashing algorithm has changed, this shouldn't prevent account migration - a server should simply authenticate using the previous hashing algorithm, and if it passes, then re-hash the password the user's entered using the new hashing algorithm, and store this new hash.

The ONLY valid reason for not migrating passwords across would be if the original password restrictions were lax - i.e. if single character passwords were allowed. In which case, forcing users to choose new, secure, passwords would be the only valid "for security" reason as to why existing accounts couldn't be migrated.

So if I business says they can't migrate "old passwords" "for security" - there's no technical reason why they can't, but it's more likely to be that their original password policy was not up to scratch!

hmnmm, i will be back when you are more competent.