4 ms·
Big no-no: At login, you just sent me my password in clear text via email. You should never, ever be able to retrieve my clear text password, even just in order
by epaga 14y ago
Big no-no: At login, you just sent me my password in clear text via email. You should never, ever be able to retrieve my clear text password, even just in order to send it to me.
http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- 5vforest 14y agoIf they sent it to you at signup, it doesn't necessarily mean that they're storing it without encryption.
- Smerity 14y agoEmail isn't sent in an encrypted form by default so this still indicates a serious concern. Either they a) don't hash passwords or b) are happy sending passwords in cleartext across the internet to machines that you don't directly control.
- Cushman 14y agoGiven that it's http://www.easel.ly/ http://www.easel.ly/ and not https://www.easel.ly/ https://www.easel.ly/, b) kind of goes without saying.
- deelowe 14y agoThe only time a server should see a password is when it's generating or comparing against the salted hash using something like bcrypt. There should never be a way for a server to retrieve the plain text password. Ever.
- deleted 14y ago[deleted]
- jvm 14y agoThe other replies to this comment are correct, but just to be clear: USER PASSWORDS SHOULD NEVER BE STORED ON THE SERVER, EVEN IN ENCRYPTED FORM.
- TazeTSchnitzel 14y agoCorrect, you should hash them. Preferably with an algorithm designed for password hashing.
- jenius 14y agoYeah... I'm not super surprised by this really. Initially it looked fine, but the more I looked at the design and way the site worked, the more I realized it was really questionable in quality. For example: - "Infographics are 30 to 40 times more likely to be viewed and shared vs. text." - an un-cited statistic they put upfront. almost ironic - Left and right arrows don't do anything, they just hash the url - Their feedback url isn't an actual place for feedback, it's a survey - Click login - the back end is wordpress (?!) - If you view the source, you can quickly see that this was made with a pre-assembled wordpress theme (http://test.nattywp.com/preview.php?theme=ifolio http://test.nattywp.com/preview.php?theme=ifolio) - The rest of the source is an absolute mess with inline styles and scripts ... if this is the amount of effort put into the landing page, it's hard to trust the rest of it...
- jonknee 14y agoThat's because they're using WordPress, emailing passwords is how WordPress works.