3 ms·
It does mean that passwords aren't properly hashed. They may be encrypted, but that still leaves open the possibility for an engineer or attacker to have access
by redblacktree 13y ago
It does mean that passwords aren't properly hashed. They may be encrypted, but that still leaves open the possibility for an engineer or attacker to have access to plain text passwords.
- arjie 13y agoNo, it does not. You can receive the password, email it to creator, hash it, and then store it. It's not ideal because you now expose it in plaintext in the original email, but you aren't storing plaintext.
- redblacktree 13y agoYou're right. I missed the "when they create their account" part.
- gog 13y agoNo it doesn't, the registration email can be sent before the password is hashed.