Are you kidding me, Starbucks?

The Starbucks mobile app, the most used mobile-payment app in the U.S., has been storing usernames, email addresses and passwords in clear text, Starbucks executives confirmed late on Tuesday (Jan. 14). The credentials were stored in such a way that anyone with access to the phone can see the passwords and usernames by connecting the phone to a PC. No jailbreaking of the phone is necessary. And that clear text also displays an extensive list of geolocation tracking points (latitude, longitude), a treasure trove of security and privacy gems for anyone who steals the phone.

Apparently this is a purposeful choice for them, a choice between security and convenience.

“A company like Starbucks has to make the choice between usability to drive adoption and the potential for misuse or fraud,” said Charlie Wiggs, general manager and senior vice president for U.S. markets at mobile vendor Mozido. “Starbucks has opted to make it very convenient. They just have to make sure that their comfort doesn’t overexpose their consumers and their brand.”

“Yes, it does surprise me,” said Gartner security analyst Avivah Litan. “I would have expected more out of Starbucks. At least they should have informed consumers.”

And apparently Starbucks could have done that. Two executives — Starbucks CIO Curt Garner and Starbucks Chief Digital Officer Adam Brotman — said in a telephone interview that they have known for an unspecified period of time that the credentials were being stored in clear text. “We were aware,” Brotman said. “That was not something that was news to us.”

So how does Starbucks respond?

Starbucks is downplaying the potential for customers to be victimized and claims that it has made (vague and unspecified) changes that alleviate the problem. Brotman said the issue should no longer be a concern because “we have security measures in place now related to that” and “we have adequate security measures in place now.” He declined to say what those security measures were, but said that customers’ “usernames and passwords are safe,” because Starbucks has added “extra layers of security.”

Yeesh!