Passwords in plain text
plaintextoffenders.com
Passwords in plain text
1–10 of 116 posts
Re: Passwords in plain text
#2The scariest part is that there are 200+ pages of those...
Re: Passwords in plain text
#3usenetbucket.com
Usenet provider
Forgot password asks you to type a password, in which it instantly emails back to you in plaintext.
Doesn't mean it stores it in plaintext.
Re: Passwords in plain text
#4usenetbucket.com Usenet provider Forgot password asks you to type a password, in which it instantly emails back to you in plaintext. Doesn't mean it stores it in plaintext.
Exactly! That's what i thought. Mailing a password to a user on changing it is maybe not the safest, but it does not mean it saves it plaintext to the database. They can just send out an e-mail when updating the password to the database and then never use the plaintext version anymore.
Re: Passwords in plain text
#5The case where you get your new password by mail when you just changed it does not necessarily mean it is stored in plain text. They could keep it around in memory just long enough to send it by mail.
Doesn't mean it is a good idea though.
Re: Passwords in plain text
#6Scrape all the URLs from that website. Then write a browser extension that looks up the current tab's URL and turns red if it matches one of those domains. Use PRs to manage addition/subtraction of offenders to the list. Now even grandma knows when a website doesn't save your password safely and shaming them will have more impact.
Re: Passwords in plain text
#7Just use a unique password every time and rest easy.
Re: Passwords in plain text
#8The case where you get your new password by mail when you just changed it does not necessarily mean it is stored in plain text. They could keep it around in memory just long enough to send it by mail. Doesn't mean it is a good idea though.
There are some ways to do that sort of thing safely, for some value of 'safe', but they're non-trivial. Sticking the plaintext passwords in a database row is trivial. Which do you think is more common? :-(
Re: Passwords in plain text
#9usenetbucket.com Usenet provider Forgot password asks you to type a password, in which it instantly emails back to you in plaintext. Doesn't mean it stores it in plaintext.
It seems that most of these just send you your password as confirmation (or a temp one after requesting password recovery). Even assuming the best case scenario that these are just password confirmation emails, it still bothers me that my password would now be in my email as plaintext.
Re: Passwords in plain text
#10Its a little scary how big that list is.
My concern is that this is a great source of websites with poor security for potential hackers to exploit.