3 ms·
Legoland.com returns forgotten passwords in cleartext
Shocked to discover that Legoland.com returns forgotten passwords in cleartext. I didn't remember my password and clicked on the Forgot my password link. Here's the email I got:
Hello <My Name>,
We received your request for a password reminder for your account with
us. Your password is: <my password in cleartext>
Please visit the link below to log in:
http://secure.legolandcaliforniaresort.com/LLC/Account/AccountLogin.aspx
Do not reply to this message. Replies to this message are not monitored
or answered.
- bryanrasmussen 9y agothat doesn't mean it stores it in cleartext, it means they sent it to you in cleartext, which is also bad but different.
- posharma 9y agoFair point. I updated the post.
- zeep 9y agoI think it does, unless they spend resources into cracking you password right before they send it back to you (which you can almost be sure that they don't do that)...
- serf 9y agoNo, it doesn't. It means that they are able to compute the users' password with resources available to them, not that they store clear-text passwords. If a password is stored in such a way as to be decipherable by using a cryptographic algorithm to recombine multiple (hopefully some being secret) elements, it's not stored in cleartext. We don't know that this is the case as far as legoland goes, but we also don't know that they store clear-text passwords simply by being able to return one to a specific user via email. It's an unsafe practice (cleartext email password return), but it doesn't indicate much about how they choose to store passwords.
- zeep 9y agoyou should send that to http://plaintextoffenders.com/ http://plaintextoffenders.com/