2 ms·
Since we have an interesting discussion going on, would you care to share a bit about the methodology? How do you determine by external observation that a site
by marshray 14y ago
Since we have an interesting discussion going on, would you care to share a bit about the methodology?
How do you determine by external observation that a site's password handling is sufficiently bad to merit the Plain Text Offender title?
- omervk 14y agoIt depends on the evidence the submitters send us. If it's a Forgot Password or Password Reminder (or sometimes being told what your password is by a CS rep), that's evidence enough. We also allow for Here Are Your Details emails after registration as evidence, though the probability is small that passwords are stored in plaintext/reversible encryption (but we still believe it's an offense since the password is both sent over an insecure medium and is stored on the email server).
- glomph 14y agoIsn't there also the chance that they only send plain text at the time of storage? Would you still consider that a plain text offender?
- omervk 14y agoYes. We have talked about this in the past and all of the links are in the about page: http://plaintextoffenders.com/about http://plaintextoffenders.com/about