4 ms·
A former employer, that I will decline to mention by name, stored a hash of the password AND the plaintext in the database so it could be sent to people via ema
by LordKano 10y ago
A former employer, that I will decline to mention by name, stored a hash of the password AND the plaintext in the database so it could be sent to people via email when they forgot it.
I tried to explain to my boss why this was such a terrible idea and he was not hearing any of it.
- vidarh 10y agoIf I ever use the "forgot my password" functionality at a site and they mail out something that is probably my original password, I make a point of cancelling my account and sending them an e-mail explaining why I don't trust them any more.
- LordKano 10y agoYeah. As a former employee, I will not recommend them to anyone who is looking for services in that particular arena.
- robin_reala 10y agoAnd submitting the site to http://plaintextoffenders.com http://plaintextoffenders.com
- user5994461 10y agoOmg. That sounds like a public list of "Top poorly secured business sites to breach. --Reward guaranteed"
- robin_reala 10y agoThey have two classes of site that they don’t distinguish to be fair. One is the awful “You’ve forgotten your password. It’s: xxxx” where they’re just storing the password in plaintext in the database. The other is still not great but it’s less bad: “Thankyou for registering. Your registered password is: xxxx”. In this case they’ve just passed the user details to an emailer before (potentially) encrypting and storing them. Neither is good, but the first is awful.