Drupal also sends plaintext passwords out of the box (at least in Drupal 6), although it does hash the password in the database. One of the first things I do is change the wording of the welcome email.
Plain Text Offenders - Did you just email me back my own password?
41–50 of 147 posts
Re: Plain Text Offenders - Did you just email me back my own password?
#42Earlier quoted context omitted.
How so? You can easily send out an email with the plaintext password, hash it and store it securely from then on..
What if you log all sent e-mails?
Then you have a great big log full of passwords, pretty much negating any security benefit of hashing them in the first place.
Re: Plain Text Offenders - Did you just email me back my own password?
#43There are some cases when storing plaintext passwords is justified, despite all of the risks. There are cases where you can't - or shouldn't - hash passwords. For Freeversation, we store plaintext passwords for two reasons: 1. Our passwords are group passwords, which (hopefully) aren't re-used anywhere else. If someone hacks our server, the conversations stored on it are incredibly more valuable than the passwords th…
The catch is in the word hopefully.
Wishful thinking is not a successful way of doing things in engineering.
Re: Plain Text Offenders - Did you just email me back my own password?
#44Earlier quoted context omitted.
A secure website should be mathematically incapable of ever displaying your plaintext password in any form whatsoever, at any time, even during the registration process.
If you have a public key associated with your email address on a public keyserver, they could encrypt your password—using said key—when you set it, and then store only the encrypted copy. Then, even though they were holding it, the only person who could do anything with it is you :)
That should address their accessibility concerns :)
Re: Plain Text Offenders - Did you just email me back my own password?
#45Codeweavers, the creators of Crossover for Linux and OS X, do this. I emailed them about it around a year ago and they never bothered to reply back, even though I've bought several licenses from them over the years.
Re: Plain Text Offenders - Did you just email me back my own password?
#46Earlier quoted context omitted.
A secure website should be mathematically incapable of ever displaying your plaintext password in any form whatsoever, at any time, even during the registration process.
By that logic, how should the website know what password it should be hashing?
The hashing should be done in the client's browser. The plaintext password should never reach the server (which is capable of sending emails).
Re: Plain Text Offenders - Did you just email me back my own password?
#47There are some cases when storing plaintext passwords is justified, despite all of the risks. There are cases where you can't - or shouldn't - hash passwords. For Freeversation, we store plaintext passwords for two reasons: 1. Our passwords are group passwords, which (hopefully) aren't re-used anywhere else. If someone hacks our server, the conversations stored on it are incredibly more valuable than the passwords th…
The catch is in the word hopefully . Wishful thinking is not a successful way of doing things in engineering.
If someone creates and conversation and re-uses a password, that password is emailed to everyone they invited. There is no way to avoid that and still use a group password.
Edit: Furthermore, the password is not associated with a specific email address or user name. Even if someone has access to a conversation's password, they don't know who the password belongs to.
Re: Plain Text Offenders - Did you just email me back my own password?
#48Earlier quoted context omitted.
To be fair the Mailman registration page explicitly tells you not to use a secure password as it'll be mailed back to you in plain text.
And to be fair, you can't really do anything with that password except change your subscription status. That said, version 3 is in the works and I read that "feature" is going away.
I don't know, do the admins not get sent the email too as they are subscribed? It's a loooong time since I used mailman.
Re: Plain Text Offenders - Did you just email me back my own password?
#49There are some cases when storing plaintext passwords is justified, despite all of the risks. There are cases where you can't - or shouldn't - hash passwords. For Freeversation, we store plaintext passwords for two reasons: 1. Our passwords are group passwords, which (hopefully) aren't re-used anywhere else. If someone hacks our server, the conversations stored on it are incredibly more valuable than the passwords th…
No, it's only the worst-case scenario for you. The worst-case scenario for the users (your customers) is their password exposed. They don't care about your server.
Re: Plain Text Offenders - Did you just email me back my own password?
#50There are some cases when storing plaintext passwords is justified, despite all of the risks. There are cases where you can't - or shouldn't - hash passwords. For Freeversation, we store plaintext passwords for two reasons: 1. Our passwords are group passwords, which (hopefully) aren't re-used anywhere else. If someone hacks our server, the conversations stored on it are incredibly more valuable than the passwords th…
No, it's only the worst-case scenario for you. The worst-case scenario for the users (your customers) is their password exposed. They don't care about your server.
Again, it's not a private password if they chose to share it with a group.