4 ms·

But... a proper password reset mechanism wouldn't send the password via email in first place, but rather a one-time link to set a new one.

• jiggy2011 14y ago
  True, but perhaps they find 0.5% of users get confused by that screen and that 0.5% represents several million £ in revenue.
  • Sottilde 14y ago
    And imagine how much being hacked affects revenue! I don't doubt, though, that some sort of similar short-sighted thinking led to this decision. Is it really possible that such a large organization simply doesn't understand password policy? Not to mention, an organization that's on the board of PCI-DSS?
    • jiggy2011 14y ago
      Possibly not that much, as long as their security is good enough that they don't get sued. At the point where you are worrying about hashed passwords, your system has already been owned. It also depends on public reaction to the incident, people won't necessarily blame tesco either and blame the "1337 chinese super h4x0rs"