3 ms·

Last time I interacted with Magento, one of their customer service people verified my plain text login password over the phone. edit: (it was about 5 years ago

Last time I interacted with Magento, one of their customer service people verified my plain text login password over the phone. edit: (it was about 5 years ago)

tedivm 8y ago
I honestly don't know how that's possible, as right from the start Magento used a (very crappy) MD5+SALT scheme for password encryption. Here's a 2013 version of their password hashing file[1] which should confirm that they were using the (very crappy) method back then. OSCommerce, which Magenta was attempting to replace, had password hashing as far back as 2006. Maybe you're thinking of a different service? 1. https://github.com/nexcess/magento/blob/master/app/code/core/Mage/Core/Model/Encryption.php https://github.com/nexcess/magento/blob/master/app/code/core...
- snorlaxle 8y ago
  I know it sounds implied but he didn't say customer service had access to plain text password, just that he verified it over the phone. You can surely do that with hashed password but it's still not a good practice.
  - damon_c 8y ago
    I was not enjoying Magento and my password was something like "MagentoSuck$" I don't remember who I was talking to exactly but they said something like "and you're logging in with the username <whatever> and the password (fading awkwardly) MagentoSucks..."? And we both kind of laughed nervously...
- bigiain 8y ago
  "Last time I interacted with Magento, one of their customer service people" That sounds to me more like they were dealing with the Meganto support portal rather than the Magento ecommerce software itself - a quick peek right now suggests that's Zen Desk. I don't know if ZenDesk admins have access to cleartext user passwords, or if Magento's ZenDesk agents regularly ask people for passwords and have a means of verifying them - but it's not a good look either way.
- powelles 8y ago
  A default Magento 1.* install emails a plain text copy of a users password upon account creation. https://raw.githubusercontent.com/OpenMage/magento-mirror/magento-1.9/app/locale/en_US/template/email/account_new.html https://raw.githubusercontent.com/OpenMage/magento-mirror/ma...

Last time I interacted with Magento, one of their customer service people verified my plain text login password over the phone. edit: (it was about 5 years ago)

tedivm 8y ago

I honestly don't know how that's possible, as right from the start Magento used a (very crappy) MD5+SALT scheme for password encryption. Here's a 2013 version of their password hashing file[1] which should confirm that they were using the (very crappy) method back then. OSCommerce, which Magenta was attempting to replace, had password hashing as far back as 2006. Maybe you're thinking of a different service? 1. https://github.com/nexcess/magento/blob/master/app/code/core/Mage/Core/Model/Encryption.php https://github.com/nexcess/magento/blob/master/app/code/core...

snorlaxle 8y ago
I know it sounds implied but he didn't say customer service had access to plain text password, just that he verified it over the phone. You can surely do that with hashed password but it's still not a good practice.
- damon_c 8y ago
  I was not enjoying Magento and my password was something like "MagentoSuck$" I don't remember who I was talking to exactly but they said something like "and you're logging in with the username <whatever> and the password (fading awkwardly) MagentoSucks..."? And we both kind of laughed nervously...
bigiain 8y ago
"Last time I interacted with Magento, one of their customer service people" That sounds to me more like they were dealing with the Meganto support portal rather than the Magento ecommerce software itself - a quick peek right now suggests that's Zen Desk. I don't know if ZenDesk admins have access to cleartext user passwords, or if Magento's ZenDesk agents regularly ask people for passwords and have a means of verifying them - but it's not a good look either way.
powelles 8y ago
A default Magento 1.* install emails a plain text copy of a users password upon account creation. https://raw.githubusercontent.com/OpenMage/magento-mirror/magento-1.9/app/locale/en_US/template/email/account_new.html https://raw.githubusercontent.com/OpenMage/magento-mirror/ma...