4 ms·
Who cares if it's technically possible not to store a password in plain text even though it's in an e-mail? For one, I do. There's a world of difference betwee
by mootothemax 15y ago
Who cares if it's technically possible not to store a password in plain text even though it's in an e-mail?
For one, I do. There's a world of difference between handing a http post and storing passwords in the clear in the db.
If they're sending passwords in plaintext they're incompetent and not to be trusted, especially for this kind of service. Ouch.
I pretty much agree, but stand by my point that sending a password in a confirmation email is the lesser of the two evils.
- dlikhten 15y agoOk for me, storing an encrypted password that is reversible is the same thing as storing a plaintext password. Means that people at least in their company can see my PW. Which means that if I used same PW as my email, they have it. Lets take it a step further... If this is insecure, how much trust can you put that your data is secure? The goal of good online backups is that the only way to actually read data from the backup is to have the user's password. They clearly don't have that as everything is reversible. Dropbox used to claim to be like that, not anymore. Which is why I don't trust dropbox with private data. Instead I store it using AeroFS with local replication.
- nodata 15y agoI don't think he meant that the password is stored in a reversible format. He meant that the e-mail is sent out before the password is encrypted and stored.
- mootothemax 15y agoThanks, this is exactly what I meant :)