5 ms·

Emailing the password is bad and they should stop, but where is the evidence that they are storing the password in plaintext?

• dpark 15y ago
  The fact that they sent it in an email in response to a user request means that they are at least storing it in a reversible format. Given that they sent the password in plaintext via email, I see no reason to believe they are competent enough to set up a reversible system that is more secure than plaintext (e.g. rot13 isn't more secure but isn't technically plaintext; storing an encrypted password with the key isn't more secure). In all likelihood, they are storing in plaintext or an equivalent.
  • coin 15y ago
    reversible != plaintext
    • dpark 15y ago
      Could you not be bothered to read my comment before replying?
• webignition 15y ago
  The story only details the sending of a password in plain text. You are right in that this provides no evidence of the password being stored in plain text. It is equally plausible, without further evidence, that pingdom is merely changing the password (a likely case if the password is not retrievable) and emailing the new password. I tested this with my pingdom account for which I know the password. The email I received contained my password and not a new password. This confirms that pingdom is storing passwords in a retrievable fashion, whether that be plain text or some form of non-one way encryption.
• 16s 15y ago
  It's not inherently bad. It's a trade-off between security and convenience. Believe it or not, most of the time, business managers are far more concerned about the user experience and the convenience of use rather than information security. It's not black and white. It's a decision with trade-offs either way.