4 ms·
Nearly all websites mail out replacement passwords (or password reset tokens) in plain text. That is not good but is hardly unique to HN. I was about to say "
by finnw 15y ago
Nearly all websites mail out replacement passwords (or password reset tokens) in plain text. That is not good but is hardly unique to HN.
I was about to say "HN doesn't do SSL" but just tested and it does. I wouldn't make a habit of this though - the site struggles with current traffic levels as it is.
- bazzargh 15y agoPassword reset tokens are single-use. If the resets are time- and IP- limited then attacking them is awkward (reset a password while the victim's in the same room?) I don't think "nearly all" is right. I've never worked on a site which mailed out plaintext passwords; and I can't think of a site I regularly use (other than HN) that does it. However, I tend to close accounts if sites mail me plaintext passwords - so my sample's a bit self-selecting.