4 ms·

Mailing lists traditionally rely minimally on passwords. The "password" field at http://mailinglists.sqlite.org/cgi-bin/mailman/listinfo/sqlite-users http://mai

Mailing lists traditionally rely minimally on passwords. The "password" field at http://mailinglists.sqlite.org/cgi-bin/mailman/listinfo/sqlite-users http://mailinglists.sqlite.org/cgi-bin/mailman/listinfo/sqli... has this copy: "You may enter a privacy password below. This provides only mild security, but should prevent others from messing with your subscription. Do not use a valuable password as it will occasionally be emailed back to you in cleartext." This is arguably better security because you can leave the password field blank, and a random one will be generated for you. That protects non-tech people from accidentally using a valuable password for something that is not actually security-sensitive.

IshKebab 8y ago
Clearly not everyone reads the small print and even if they did that doesn't really excuse it in today's internet. Hashing passwords is not hard.
- joesb 8y ago
  Hashing password has nothing to do with sending email in plaintext. You can hash password and also email password in clear text at sign up, when you still have access to the password. And it doesn't even make sense to send hash of the password back in email.
  - IshKebab 8y ago
    I wasn't talking about sending emails.
    - mort96 8y ago
      But... the conversation was about sending the password in emails.
      - IshKebab 8y ago
        Read the comment I replied to. It explains that the passwords are not hashed at all. They are not sent in an email and then hashed. I was talking about the practice quoted in that comment of not hashing passwords. Edit: To be clear it doesn't say it explicitly, but it says that the cleartext password is sent periodically and the only way to do that is to not hash it.
OskarS 8y ago
That is just terrible policy. Password reuse is probably the biggest security problem there is, and until we can convince every human on the planet to use a password manager, every person that has to store a password needs to do so in a secure fashion. Saying "don't use a high-value password" is terrible practice.

IshKebab 8y ago

Clearly not everyone reads the small print and even if they did that doesn't really excuse it in today's internet. Hashing passwords is not hard.

joesb 8y ago
Hashing password has nothing to do with sending email in plaintext. You can hash password and also email password in clear text at sign up, when you still have access to the password. And it doesn't even make sense to send hash of the password back in email.
- IshKebab 8y ago
  I wasn't talking about sending emails.
  - mort96 8y ago
    But... the conversation was about sending the password in emails.
    - IshKebab 8y ago
      Read the comment I replied to. It explains that the passwords are not hashed at all. They are not sent in an email and then hashed. I was talking about the practice quoted in that comment of not hashing passwords. Edit: To be clear it doesn't say it explicitly, but it says that the cleartext password is sent periodically and the only way to do that is to not hash it.

OskarS 8y ago

That is just terrible policy. Password reuse is probably the biggest security problem there is, and until we can convince every human on the planet to use a password manager, every person that has to store a password needs to do so in a secure fashion. Saying "don't use a high-value password" is terrible practice.