5 ms·

These are usernames and passwords but your sentiment is correct. Something needs to be fixed there too. First thing is for us to develop good password habits an

by Varcht 13y ago

These are usernames and passwords but your sentiment is correct. Something needs to be fixed there too. First thing is for us to develop good password habits and stop using the same one on several sites.

a3n 13y ago
It would also help if sites didn't store unencrypted passwords and didn't send passwords in email. The article says a lot of the records included unencrypted passwords; why do they exist in that form?
- yeukhon 13y ago
  This. I have requested to redhat mailing list several times to STOP sending mailman account reminder with my password in plaintext. And they still do and no one listens. I give up on it and unsubscribe immediately. Away from any redhat mailing list from that point. "redhat.com mailing list memberships reminder" It's bullshit when people send my password in plaintext to my email account and they ignore my complains when they said "if you have questions send to this owner emaiil." Bullshit. Why do they need to remind me about my password in the first place? From what I can tell mailman stores thing in plaintext. I personally don't see why anyone can't write 20 lines of code to do a crypt with sha256/sha512 (crypt$5, crypt$6). It's almost idiotic. https://www.owasp.org/index.php/About_Mailman_at_OWASP https://www.owasp.org/index.php/About_Mailman_at_OWASP
  - rinon 13y ago
    This is getting somewhat off-topic, but Mailman warns you during the sign-up process that this password will be sent in cleartext, so do not use a valuable password. In fact, if you leave the password field blank mailman will kindly generate a random password and send you that. If your subscription status on a mailing list is valuable enough to care about compromise, then I recommend you not use an email list at all.
  - nknighthb 13y ago
    The number of imbeciles annoying the clueful population with misplaced unsubscribe requests and similar noise would be even higher without the reminder and included password.

by Varcht 13y ago

a3n 13y ago

It would also help if sites didn't store unencrypted passwords and didn't send passwords in email. The article says a lot of the records included unencrypted passwords; why do they exist in that form?

yeukhon 13y ago
This. I have requested to redhat mailing list several times to STOP sending mailman account reminder with my password in plaintext. And they still do and no one listens. I give up on it and unsubscribe immediately. Away from any redhat mailing list from that point. "redhat.com mailing list memberships reminder" It's bullshit when people send my password in plaintext to my email account and they ignore my complains when they said "if you have questions send to this owner emaiil." Bullshit. Why do they need to remind me about my password in the first place? From what I can tell mailman stores thing in plaintext. I personally don't see why anyone can't write 20 lines of code to do a crypt with sha256/sha512 (crypt$5, crypt$6). It's almost idiotic. https://www.owasp.org/index.php/About_Mailman_at_OWASP https://www.owasp.org/index.php/About_Mailman_at_OWASP
- rinon 13y ago
  This is getting somewhat off-topic, but Mailman warns you during the sign-up process that this password will be sent in cleartext, so do not use a valuable password. In fact, if you leave the password field blank mailman will kindly generate a random password and send you that. If your subscription status on a mailing list is valuable enough to care about compromise, then I recommend you not use an email list at all.
- nknighthb 13y ago
  The number of imbeciles annoying the clueful population with misplaced unsubscribe requests and similar noise would be even higher without the reminder and included password.