11 ms·
The worst offender I can recall was Wordpress.com. Not only do they email you your password back, but show it to both you and whoever might be sitting within a
by estel 16y ago
The worst offender I can recall was Wordpress.com. Not only do they email you your password back, but show it to both you and whoever might be sitting within a few metres in LARGE LETTERS in the webpage immediately after activating your account.
After I emailed to complain about this, they said:
"Security and usability is often a trade-off. We make two main ones:
* When you register at WordPress.com, we show you your password and email it to you.
* When you log in we tell you whether the username or password was incorrect.
The accessibility and increased convenience for users in both cases has been deemed to be worth it."
Edit: I just checked, and it seems that they've changed this element of their policy. The situation above was March 2009.
- Kudos 16y agoAt least it's some consolation that they don't store the password in plain text, unlike plentyoffish.com. Do they also email you your new password if you change it?
- estel 16y agoSorry, I didn't clarify: they showed in plaintext the password that I supplied and emailed my password back to me.
- mootothemax 16y agoEmailing a password after registration does not, in itself, indicate that passwords are being stored in plain text.
- JonnieCache 16y agoA secure website should be mathematically incapable of ever displaying your plaintext password in any form whatsoever, at any time, even during the registration process.
- derefr 16y agoIf you have a public key associated with your email address on a public keyserver, they could encrypt your password—using said key—when you set it, and then store only the encrypted copy. Then, even though they were holding it, the only person who could do anything with it is you :)
- zacharypinter 16y agoThat should address their accessibility concerns :)
- joe_the_user 16y agoUh... The standard, minimal approach is to keep secure hash of each password and throw away the password itself. This has the same effect but doesn't require the average, unsophisticated user to have a public keep. But that's just the bare minimum approach - from there, you add a "salt" and other things. Done well enough, you should have a system where downloading your entire system shouldn't compromise your users passwords. But that's only if this is done really well - the write-up for how hbgarey got hacked actually is a great intro to this kind of thing. http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars/ http://arstechnica.com/tech-policy/news/2011/02/anonymous-sp...
- derefr 16y agoMy point was that you can retain the ability to email the user their own password with no loss of security (provided the user has a public key—like, say, Github or Heroku require, as they use passwordless ssh for repository synchronization.) My point was not that keeping someone's password around, is any better an idea than just allowing them to reset it :)
- psaintla 16y agoIf they use the same codebase that is on opensource wordpress they store the password as an md5 hash which isn't much better. Take a look at the wordpress source code one day, you'll be horrified.
- MartinCron 16y agoI spent around two years working on some of the highest traffic Wordpress sites out there and I came to the Winston Churchill-like conclusion that Wordpress is the worst blogging platform out there, except for all of the others that have been tried.
- psaintla 16y agoI totally disagree, Habari's code base is far superior to wordpress in every regard it simply needs a larger user base. Try it if you are looking for a new blogging platform you'll be pleasantly surprised. http://habariproject.org http://habariproject.org
- MartinCron 16y agoI wouldn't argue that Habari is probably better code than WordPress, but it doesn't seem fair to compare a 0.7 product to something as functional and battle-tested as WordPress.