5 ms·
Never send my password to me via email.
by zacharydanger 18y ago
Never send my password to me via email.
- tptacek 18y agoWow --- it really did mail me my password. Why are you storing my raw password? Stop that! Most of your users are using the same password for their Yahoo Mail account, which is effectively their bank account. What you have now is a brand new application which hasn't been reviewed for security that is building a database of bank-account-equivalent passwords, which you will lose entirely to the first person who finds an SQL error on your site. The convention is for your email address to reset your password, mailing the new random password or a code that can be used on your site to enter a new password. Unfortunately, the convention you adopted betrays the fact that you're not storing passwords safely to begin with. If you're using Rails, start with bcrypt-ruby for your passwords. If you're using PHP, try PHPass, which is also bcrypt. Django or Python, try py-bcrypt. Not even your administrators should know what your users passwords are.
- jsvaughan 18y agoYou're both absolutely right - I'll get this sorted immediately