W T F. I just opened an account with them. Im not too happy. Always seems disrespectful of companies to do that. I think they should at least inform you before you make the account that they are sacrificing your privacy and security in order to cut down on customer service requests.
Hover.com: we store & email passwords in plaintext for usability
21–30 of 190 posts
Re: Hover.com: we store & email passwords in plaintext for usability
#22Couldn't they at least encrypt it, and store the key on a separate file? *edit: I just want to be clear, I don't actually think encryption would a sufficient replacement for a good hashing function, the question was just pointing out how bad this decision by Hover was; not only do they decide to make the password recoverable, but they don't even take whatever meager opportunities there are to make it at least somewha…
Generally it's pretty easy to get root on a system. Then you're generally 100% owned. The only away this will survive is on the good graces of malicious hackers everywhere.
Re: Hover.com: we store & email passwords in plaintext for usability
#23"Sorry sir, we really don't know how much money is suppose to be in your account. Our developers thought that transactions added too much overhead, so they decided to drop them to insure that the increased response time wouldn't anoy our customers."
Re: Hover.com: we store & email passwords in plaintext for usability
#24Damnit, transferring domains is such a pain in the ass.
Re: Hover.com: we store & email passwords in plaintext for usability
#25I emailed them about this a few months ago after being spurred on by the creation of plaintextoffenders.com:
> I received this email when I registered with you last year, and was prompted by the recent creation of the site 'Plain Text Offenders' to send it to them. Somebody else has submitted their registration email too:
The reply was as follows:
> We realized that this area was of great concern to many customers and we have since removed password submission in our 'Welcome' email.
So to give their customers peace of mind, they made it less obvious that what they're doing is stupid.
Re: Hover.com: we store & email passwords in plaintext for usability
#26Maybe this is all an elaborate practical joke.
Or maybe they wanted to test their security, so they're putting out an all-call to every blackhat out there.
Because either of those makes a lot more sense than what they've said.
Re: Hover.com: we store & email passwords in plaintext for usability
#27Earlier quoted context omitted.
Which ones? the panel?
Yes. They will email your password to you if you click the "forgot my password" link.
ARGH! I just confirmed this. So disappointed. I've changed it now to be completely unique but I wouldn't be surprised if it's logged somewhere.
Re: Hover.com: we store & email passwords in plaintext for usability
#28At least they make a case for it. Security isn't just how you store passwords.
No, but it's pretty damn important. All it takes is one disgruntled employee, one uninformed sys-admin, one mistake, and boom, all that "security" is gone.
Re: Hover.com: we store & email passwords in plaintext for usability
#29This really isn't that uncommon. When forced to choose between easier customer support or ostensibly better security practices, easier customer support usually wins. Stolen passwords through email/eavesdropping are rare enough that they can deal with it on a case-by-case basis. If someone somehow gets access to the entire database of passwords (also rare) then they have other security issues that likely would have been a problem no matter how they stored passwords.
If company X hashes your password on their server you still don't know that they did it properly or how good the rest of their security is. Basically the only way this differs is that you when you forget your password, your actual password sent in plaintext over the network and is now sitting in your email account. That makes me uncomfortable so I change it right away. Which is the exact same set of steps you would use for a hashed password reset.
Everybody focuses on the hashing thing like it is some kind of impenetrable defense or crystal ball into a company's security practices. It is not.
Re: Hover.com: we store & email passwords in plaintext for usability
#30This seems like a good time to mention that I highly recommend using the Password Hasher extension if you are on FireFox. It does help to alleviate problems like this:
https://addons.mozilla.org/en-US/firefox/addon/password-hash...