4 ms·
How is this even implemented safely? The passwords have to be forwarded over to the email provider, so they are flying around log files, unsafe in the database
by fareesh 8y ago
How is this even implemented safely?
The passwords have to be forwarded over to the email provider, so they are flying around log files, unsafe in the database. There's actually a programmer somewhere who can read all of them and put them in a text file and take them home.
- icebraining 8y agoIn theory, the password doesn't have to be stored at all. I bet it's kept in some sort of job queue, so it might be stored in disk (e.g. Redis AOF), but even that could be avoided. Still, one has to wonder why do it at all, considering the simple alternative of sending a verification email, which was already implemented.
- fareesh 8y agoIsn't the motive to get the user's contact lists? If there's an error isn't there a chance that the password leaks out into an error log somewhere?
- icebraining 8y ago> Isn't the motive to get the user's contact lists? Probably, yeah. > If there's an error isn't there a chance that the password leaks out into an error log somewhere? Sure; there are ways of avoiding that, but who knows what they did.