3 ms·

Such as?

• jethro_tell 7y ago
  storing the password in plain text so you can just find it in a data breach when you loose your password.
• Deimorz 7y ago
  On Tildes, I let people add a recovery email address for their account, but I hash it (with Argon2), and if anyone needs to do an account recovery they have to send an email requesting it from that address, including their username. Then I hash the sending email address and only send reset info back if it matches the stored hash for the account. There are still some minor issues with doing it that way, but it's much, much better than storing plaintext email addresses. I don't know of any other sites doing it this way, but I wouldn't be surprised if others have thought of the same method.