3 ms·
How do people try to justify storing passwords in recoverable form? So that they can remind users of the old password. How do they actually send the reminder?
by jedbrown 15y ago
How do people try to justify storing passwords in recoverable form? So that they can remind users of the old password.
How do they actually send the reminder? By email.
But email is not secure, you should always assume that someone is eavesdropping on your email. Far too many users reuse a password from one service on others, so sending a password in email is a huge violation of trust.
- tomp 15y agoStoring passwords in plain text (or using an encryption method) and sending password over email are two distinct issues. I think storing passwords (and not only hashes of passwords) might be a good idea if it is harder for the attacker to recover the passwords than to gain root access to the http/database server, however, I would NEVER send passwords in emails (not even newly generated passwords). A simple solution is to send a one-time login link, and have the password displayed in the browser, over a https:// https:// connection. There is still a small possibility of stealing the password (someone intercepts the email and clicks on the link before the legitimate user does), but at least the user would become aware of it (his link wouldn't work any more).
- jedbrown 15y agoOne issue is that even if the password database is more secure than root access on the server, having the database at all means that it's possible to steal the entire thing in a small amount of time and in a way that may be difficult to detect. An attacker with root access on the server would have to keep the exploit open to continue gathering user credentials. And I still don't see what convenience having the password database offers. One-time links are definitely the right way, though I think it's better to give the user a new password dialog than to tell them a randomly generated password.
- deleted 15y ago[deleted]