Smartphone apps from Walmart, CNN, ESPN, Slack, others with total of 300M downloads risk compromising user accounts because they do not limit login attempts
Dan Goodin / Ars Technica :
Context & Ripple Effects
The finding lands mid-decade as big brands were racing consumers onto their own mobile apps: by Dan Goodin's reporting, apps from Walmart, CNN, ESPN, Slack and other developers with 300M combined downloads simply don't cap failed logins, handing attackers unlimited guesses at user credentials. It is not an isolated slip — months later Target's own [[a:838068|mobile wish-list app was caught exposing personal data through an API with no authentication]] at all.
The pattern held well past 2015: a later [[a:963834|Zimperium analysis found 14% of Android and iOS apps touching AWS or Azure had cloud misconfigurations exposing user data]], and Facebook conceded hackers could pivot from its platform into Instagram and Oculus accounts via Facebook Login. Authentication, the layer everything else sits on, has been the recurring weak joint in consumer mobile.
First-order effects
- Users of the affected apps — Walmart shoppers among them — face brute-force account-takeover risk right now, since nothing stops an attacker from retrying passwords indefinitely against a 300M-download installed base.
- The named brands must retrofit rate-limiting and lockout controls into live apps, an engineering fix that touches every login flow rather than a single patch.
Second-order effects
- Retail peers get a cautionary benchmark: Target's earlier unauthenticated-API embarrassment shows the reputational cost of shipping a consumer app before hardening its auth, pressuring rivals like Walmart to audit their own mobile stacks.
- Centralized sign-on providers gain the argument — the Facebook Login cascade demonstrated how one identity layer's compromise spreads across third-party apps, making 'bring your own login' both a convenience sell and a shared-liability pitch.
Third-order effects
- If the pattern holds, app-store operators move from policing malware (the Play Store purge of credential-stealing photo apps being the enforcement model) toward policing authentication hygiene itself, making rate-limiting a de facto listing requirement for high-volume consumer apps.
- Consumer trust consolidates around whoever enforces login discipline — brands with weak account security cede the mobile relationship, which matters most where the app fronts payments and loyalty programs like retail.
The trend: Consumer mobile apps keep failing at basic account authentication — from missing rate limits to misconfigured clouds — pushing the industry toward enforced identity baselines set by platforms and concentrated login providers.