3 ms·
Is it bad practice to get your password in an email? I thought that's what happens when you reset your password
by rifung 10y ago
Is it bad practice to get your password in an email? I thought that's what happens when you reset your password
- jammycakes 10y agoYes it is. The recommended approach these days for password resets is to email you a single-use, time-limited link to a page where you can choose a new password.
- paxunix 10y agoIf a site can email you your password, they are basically storing it in clear text. Otherwise they could not send you your password (because they would only have the hash of it). This is clearly a huge security risk.
- prashnts 10y agoI suppose they can generate the password, and email it to you before storing the hashed password in database?
- greenpizza13 10y agoThey could. The real issue is when you do a 'forgot password' and they send it to you. That's a big red flag.
- gmuslera 10y agoIf you use a site where you store sensible information and send your unencrypted password back by mail, delete all your information from there and leave. Email is not designed for secure information transfer, in a lot of cases your password will travel in plain text over the network and passing that way potentially over several servers. And besides that, if they store your password in plain text a way that can be recovered the original version, if that site gets hacked the other sites where you may be using that password or a trivial modification of it (i.e. if you use a base password+site name) will give them your password. Happened to 38M Adobe users 3 years ago https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/ https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-pas...