1–10 of 147 posts
Plain Text Offenders - Did you just email me back my own password?
plaintextoffenders.com
After I emailed to complain about this, they said:
"Security and usability is often a trade-off. We make two main ones:
* When you register at WordPress.com, we show you your password and email it to you. * When you log in we tell you whether the username or password was incorrect.
The accessibility and increased convenience for users in both cases has been deemed to be worth it."
Edit: I just checked, and it seems that they've changed this element of their policy. The situation above was March 2009.
The worst offender I can recall was Wordpress.com. Not only do they email you your password back, but show it to both you and whoever might be sitting within a few metres in LARGE LETTERS in the webpage immediately after activating your account. After I emailed to complain about this, they said: "Security and usability is often a trade-off. We make two main ones: * When you register at WordPress.com, we show you your…
The worst offender I can recall was Wordpress.com. Not only do they email you your password back, but show it to both you and whoever might be sitting within a few metres in LARGE LETTERS in the webpage immediately after activating your account. After I emailed to complain about this, they said: "Security and usability is often a trade-off. We make two main ones: * When you register at WordPress.com, we show you your…
At least it's some consolation that they don't store the password in plain text, unlike plentyoffish.com. Do they also email you your new password if you change it?
The worst offender I can recall was Wordpress.com. Not only do they email you your password back, but show it to both you and whoever might be sitting within a few metres in LARGE LETTERS in the webpage immediately after activating your account. After I emailed to complain about this, they said: "Security and usability is often a trade-off. We make two main ones: * When you register at WordPress.com, we show you your…
At least it's some consolation that they don't store the password in plain text, unlike plentyoffish.com. Do they also email you your new password if you change it?
Earlier quoted context omitted.
At least it's some consolation that they don't store the password in plain text, unlike plentyoffish.com. Do they also email you your new password if you change it?
Sorry, I didn't clarify: they showed in plaintext the password that I supplied and emailed my password back to me.
Earlier quoted context omitted.
At least it's some consolation that they don't store the password in plain text, unlike plentyoffish.com. Do they also email you your new password if you change it?
A secure website should be mathematically incapable of ever displaying your plaintext password in any form whatsoever, at any time, even during the registration process.
Earlier quoted context omitted.
At least it's some consolation that they don't store the password in plain text, unlike plentyoffish.com. Do they also email you your new password if you change it?
A secure website should be mathematically incapable of ever displaying your plaintext password in any form whatsoever, at any time, even during the registration process.
Unbelievable.