Protecting consumers’ credit card information has been a very hot topic lately, with major retailers gearing up for the frantic holiday season. But how that information is protected in mobile applications has come into the security mix thanks to a recent discovery by Waldera that the most basic of precautions to protect this kind of information have not been taken by certain companies.

What’s the Problem?

Cloud and mobile provider Waldera found that a few organizations were not using the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocol for encryption of the information as it was sent from a mobile app to company servers.

All the companies that were discovered to have this flaw were notified of the issue by Wandera, which estimated that the affected apps collectively serve 500,000 customers a day.

SSL/TLS is an encryption method that is most commonly identified in a browser by the HTTPS prefix in the site’s URL. But in a dedicated app, this kind of information will not be displayed since there is no URL bar. The information is just transmitted without the user knowing the actual mechanism used.

If the data has not been protected, then someone on the same network could intercept it. Since it is not encrypted and it is personally identifiable, the user would be directly at risk. Public Wi-Fi access is always suspect since it can be spoofed by someone to execute man-in-the-middle (MitM) attacks.

They Fixed It, Right?

Waldera found that five of the 16 companies notified have now fixed this problem. The ones that patched the vulnerability included easyJet, Chiltern Railways, the San Diego Zoo, CN Tower and Aer Lingus.

Companies that had not yet patched things up included many in the travel field, in both Europe and the U.S. Since these may be the types of businesses most likely to use public Wi-Fi to connect to the Internet, they will also be the types of companies that can put your unencrypted data at greatest risk.

Sometimes the primary company websites did use some form of encryption, but were not protected with encryption techniques when using mobile browsers or apps. Mobile apps may have multiple connections to back-end services through the main websites, and all these services will need to be treated with the same sort of protection as when personal information is being transmitted.

TLS has had its own share of problems, so it’s not a foolproof solution. Some implementations of the security measure have been flawed. However, it is still the best general way to protect personally identifiable information over the Web.