Boycott websites that send you email with your password in clear text
imsaar.posterous.com
Boycott websites that send you email with your password in clear text
1–10 of 30 posts
Re: Boycott websites that send you email with your password in clear text
#2So, you're telling me I should boycott the tax office here ?
That'll go down real well with them. I think I'll skip this one.
Re: Boycott websites that send you email with your password in clear text
#3At least record your protest or change your password to something not related to your real secret password.
Re: Boycott websites that send you email with your password in clear text
#4> Anybody sending you back your password in clear text is also storing it that way in their database
Incredibly ignorant statement. If it's encrypted in a reversible format then it's not cleartext. If it's being sent in a confirmation email, then it could even be stored as a one-way hash: password extracted from the form, inserted into email, hashed and stored (This is what WordPress, for example, does).
A case can be made against both of those procedures, but that is a separate issue from his statement being ignorant.
Re: Boycott websites that send you email with your password in clear text
#5Ummm. Google Apps does this.
Re: Boycott websites that send you email with your password in clear text
#6> Anybody sending you back your password in clear text is also storing it that way in their database Incredibly ignorant statement. If it's encrypted in a reversible format then it's not cleartext. If it's being sent in a confirmation email, then it could even be stored as a one-way hash: password extracted from the form, inserted into email, hashed and stored (This is what WordPress, for example, does). A case can b…
Incredibly educational comment. I stand corrected that it is not necessarily true that they would store it in clear text in the database but if someone is sending me password in clear text in email I would not give them a lot of benefit of doubt to do the right thing.
Besides, what is the utility of sending such an email. If certain software is open source and I can assure they are doing the right thing I will be much more comfortable.
Re: Boycott websites that send you email with your password in clear text
#7Ummm. Google Apps does this.
I think Google Apps does this when you are setting up a new user account for other user. Sending that is different as in they need the password to access their account for the first time.
Although there are better ways to setup an account and may be gogle app should force the user to change their password on their first login but this is not the same as me setting up my own account and getting an email with my own password I just typed twice to register.
Re: Boycott websites that send you email with your password in clear text
#8I am glad I am not the only one who feel sending passwords email is a bad thing:
http://www.techconsumer.com/2008/02/11/bad-form-companies-st...
Thank you tomfakes for the comment.
Re: Boycott websites that send you email with your password in clear text
#9> Anybody sending you back your password in clear text is also storing it that way in their database Incredibly ignorant statement. If it's encrypted in a reversible format then it's not cleartext. If it's being sent in a confirmation email, then it could even be stored as a one-way hash: password extracted from the form, inserted into email, hashed and stored (This is what WordPress, for example, does). A case can b…
Incredibly educational comment. I stand corrected that it is not necessarily true that they would store it in clear text in the database but if someone is sending me password in clear text in email I would not give them a lot of benefit of doubt to do the right thing. Besides, what is the utility of sending such an email. If certain software is open source and I can assure they are doing the right thing I will be muc…
I store passwords as a hash in the database, but send it to the user in plaintext when they register. Why?
1. I didn't used to do this, but I got so many requests that I eventually caved. 2. No money changes hands on the site.
Re: Boycott websites that send you email with your password in clear text
#10I don't think a boycott is the best way to proceed with this problem. For starters, I don't think you will get enough publicity to bring a boycott to critical mass. Secondly, I think it would be more useful and effective to send an email to the perpetrating website, inquiring or complaining about their password storage techniques. When customers/users complain, a good business will respond and attempt to resolve the problem.