3 ms·

A side question: why would a normal person paste password in the password field? Its either autofilled or he types it in. Only case I see this happening is when

A side question: why would a normal person paste password in the password field? Its either autofilled or he types it in. Only case I see this happening is when you get the password in the email from website and are asked to enter that, which itself would be a bad practice.

Ao7bei3s 10y ago
Because I'm using a password manager. Why shouldn't normal people use password managers?
rifung 10y ago
Is it bad practice to get your password in an email? I thought that's what happens when you reset your password
- jammycakes 10y ago
  Yes it is. The recommended approach these days for password resets is to email you a single-use, time-limited link to a page where you can choose a new password.
- paxunix 10y ago
  If a site can email you your password, they are basically storing it in clear text. Otherwise they could not send you your password (because they would only have the hash of it). This is clearly a huge security risk.
  - prashnts 10y ago
    I suppose they can generate the password, and email it to you before storing the hashed password in database?
    - greenpizza13 10y ago
      They could. The real issue is when you do a 'forgot password' and they send it to you. That's a big red flag.
- gmuslera 10y ago
  If you use a site where you store sensible information and send your unencrypted password back by mail, delete all your information from there and leave. Email is not designed for secure information transfer, in a lot of cases your password will travel in plain text over the network and passing that way potentially over several servers. And besides that, if they store your password in plain text a way that can be recovered the original version, if that site gets hacked the other sites where you may be using that password or a trivial modification of it (i.e. if you use a base password+site name) will give them your password. Happened to 38M Adobe users 3 years ago https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/ https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-pas...

Ao7bei3s 10y ago

Because I'm using a password manager. Why shouldn't normal people use password managers?

rifung 10y ago

Is it bad practice to get your password in an email? I thought that's what happens when you reset your password

jammycakes 10y ago
Yes it is. The recommended approach these days for password resets is to email you a single-use, time-limited link to a page where you can choose a new password.
paxunix 10y ago
If a site can email you your password, they are basically storing it in clear text. Otherwise they could not send you your password (because they would only have the hash of it). This is clearly a huge security risk.
- prashnts 10y ago
  I suppose they can generate the password, and email it to you before storing the hashed password in database?
  - greenpizza13 10y ago
    They could. The real issue is when you do a 'forgot password' and they send it to you. That's a big red flag.
gmuslera 10y ago
If you use a site where you store sensible information and send your unencrypted password back by mail, delete all your information from there and leave. Email is not designed for secure information transfer, in a lot of cases your password will travel in plain text over the network and passing that way potentially over several servers. And besides that, if they store your password in plain text a way that can be recovered the original version, if that site gets hacked the other sites where you may be using that password or a trivial modification of it (i.e. if you use a base password+site name) will give them your password. Happened to 38M Adobe users 3 years ago https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/ https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-pas...