Just use a unique password every time and rest easy.
Just don't get hacked, easy.
Passwords in plain text
41–50 of 116 posts
Re: Passwords in plain text
#42Scrape all the URLs from that website. Then write a browser extension that looks up the current tab's URL and turns red if it matches one of those domains. Use PRs to manage addition/subtraction of offenders to the list. Now even grandma knows when a website doesn't save your password safely and shaming them will have more impact.
There's already a Chrome Extension for it if I'm not mistaken.
Can you share the name or link please?
Re: Passwords in plain text
#43The case where you get your new password by mail when you just changed it does not necessarily mean it is stored in plain text. They could keep it around in memory just long enough to send it by mail. Doesn't mean it is a good idea though.
Even if it's not stored at their end in plaintext it's a security issue that it's emailed in plaintext.
[deleted]
Re: Passwords in plain text
#44Used a sportsbook a few years ago where the popup to view and update your account details, which had a hidden address bar in most browsers, contained "password=" in the query string. I reported it but they assured me they were 'using encryption' and to look for the 'lock in my browser'. They were using SSL, but had no clue. The site probably handled millions of $ a week.
Re: Passwords in plain text
#45I've been just thinking about this after receiving 2 such emails in one day this week. Submitted both to the archive, thanks so much for doing this!
Name and shame, that's the minimum to make them change.
Re: Passwords in plain text
#46The case where you get your new password by mail when you just changed it does not necessarily mean it is stored in plain text. They could keep it around in memory just long enough to send it by mail. Doesn't mean it is a good idea though.
There are some ways to do that sort of thing safely, for some value of 'safe', but they're non-trivial. Sticking the plaintext passwords in a database row is trivial. Which do you think is more common? :-(
That's really trivial, and many web applications work this way:
email = input.email
plainPassword = input.password
hashed = hash(plainPassword)
saveToDb(email, hashed)
sendGreetingEmail(email, plainPassword)
Re: Passwords in plain text
#47We already have a fairly good solution to this problem in OAuth. However, current popular implementations of OAuth are third-party owned which is not desirable for many reasons (for example, google won't use facebook owned OAuth, and vice-versa). Ideally, we should have a self-owned OAuth service implemented by browsers or operating systems. And the APIs of this service should be standardized. Also, the storage shoul…
Something like the Firefox Accounts¹ project? Which has Oauth2 support² in the works. 1: https://wiki.mozilla.org/Identity/Firefox_Accounts 2: https://github.com/mozilla/fxa-oauth-server
FxA is primarily for Firefox's own products and services. Mozilla Persona (confusing name - personas is what they called firefox themes as well) is closer.
Re: Passwords in plain text
#48But how does one handle password resets without resorting in one form or another to sending some info in plain text to users?
At least one website on the current front page is there because it sent a temporary password in plain text. I assume this happened because the user forgot his password. This says nothing about how they store passwords and after all how else would you handle a password reset? Send a password reset link? That's the same thing.
Sending passwords in plaintext back to the user after he has set/changed his password is clearly a security risk but when it comes to temporary passwords or password resets how else would that info be sent?
Re: Passwords in plain text
#49Earlier quoted context omitted.
But that has nothing to do with the fact that just because the site emails you a password doesn't mean that they store the password in plaintext. The catch here is that if they email the password upon the user having entered it (made an account or changed their password, or had password generated for them, ...). If user requests a lost password and it's returned in plaintext, then one can be sure that the password is…
No problem here? It goes through so many servers, unencrypted…
Odds are that you registered over plain HTTP anyway
Re: Passwords in plain text
#50Hey guys, I'm @omervk, one of the co-founders and the maintainer of PTO. Always a pleasure to be featured on the front page of HN. You're welcome to ask me questions, though we've covered most on our about page ( http://plaintextoffenders.com/about ). The one we haven't is usually "Is there an API/better search/new site coming?" to which the answer is that we're both doing this in our spare time and though we really…
For good measure you should list websites allowing you to enter a password on a non-https page, too. That's plain text, too.