6 ms·
POF still (since I last checked) store their passwords in plain text, so for that reason I cannot give it praise
by jayflux 12y ago
POF still (since I last checked) store their passwords in plain text, so for that reason I cannot give it praise
- level09 12y agoand how would you go about checking that ?
- jayflux 12y ago2 reasons... 1. Letters of my password are shown to me with asterisks inbetween. 2. users used to get their own password sent back to them when they forgot it, rather than being forced make a new pass. Although to be fair I don't think they do 2 anymore You only have to google it to find other users saying the same thing.
- stormbrew 12y agoFor a long time it actually sent you your password in an automated email once a month just in case you happened to forget it.
- jere 12y agoInteresting. If you were to do that, it'd be much easier to send a login link.
- amenod 12y agoThis attitude might actually be the difference between them and lesser known competitors. (not that I think it's OK)
- stormbrew 12y agoWell, really, I think the big difference at the time was just that it was free. OKCupid was a later followup on the same idea, but most dating sites at the time were pay-to-message at best. You find very different people on PoF than on the pay dating sites. Or even than on OKC, which forces you to expose more of yourself to become visible.
- 30thElement 12y agoWhen this originally came up people were saying that, they use it as a reminder to keep using the site. But you can get the same benefit using a login link or something, no need for all the security issues.
- stormbrew 12y agoYep. The email itself is actually a call to action, it's telling you your new matches. And it's actually weekly. It looked like this before: Hello yournamehere, Thank you for signing up on MM/DD/YYYY HH:MM:SS XM. Remember your password is *****. http://www.plentyoffish.com is larger than all other free dating sites combined. View your latest matches here --> http://www.plentyoffish.com/viewmatches.aspx 1. You can now easily check your messages via a cell phone. 2. Latest signups -- > http://www.plentyoffish.com/lastsignup.aspx 3. Users online in your city -- > http://www.plentyoffish.com/lastonlinemycity.aspx 4. If you have found your match you can delete your account in the help menu. 5. Read your new emails here --> http://www.plentyoffish.com/inbox.aspx 6. Who checked out your profile? -->http://www.plentyoffish.com/whoviewedme.aspx 7. Compatibility Test to Measure Chemistry --> http://www.plentyoffish.com/poftest.aspx http://www.plentyoffish.com At some point the password line was just replaced with: http://www.pof.com is larger than all other free dating sites combined. So they didn't even have to make it a login link.
- underyx 12y agoThey might be storing only those shown letters in plain text, with the actual password being hashed.
- jayflux 12y agoThat was my thought at first, but it seemed a coincidence the number of Astericks matched my actual password
- TheAnimus 12y agoI am guessing they do a 'forgot password' that returns it in cleartext?
- sintaxi 12y agoIm speculating but it could be that the password reset emails you your password, or the signup notification includes your email/password.
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- philjohn 12y agoI would wager they've done a "forgotten password" action and were sent their original password, always a dead givaway. Doesn't mean they're not encrypted in the database, but that's not good enough either.
- anjc 12y agoAnd, as good as I think the site is, it's not the best looking or most modern. Which just goes to show, release early/often. Don't paralyse yourself trying to be perfect.
- saurik 12y agoInstead of being angry about how websites store your password, why not use a different password on every website? You should be doing this anyway, as due to the way the web is designed you have to trust their server at least momentarily with your password anyway, and it would be downright stupid to send them a password you use on another website.
- Goladus 12y agoThe are security implications whether you use the password anywhere else or not.
- saurik 12y agoIf the password database is somehow stolen without the website being compromised, sure. When people manage to break into the database they almost always seem to have gotten access through an exploit that takes control of the web server, though (which makes intuitive sense if you think about it). But it turns out that the really correct way of doing authentication, a challenge response rather than the idiotic "send my password to the server, allowing bugs along the route in SSL or malicious administrators to steal the password in transit", happens to make you lose that benefit anyway, as the client has to be given the algorithm to hash and salt their way to what is then effectively the password.
- jaredmcateer 12y agoIt used to be the case that a lot of their validation was also client side. E.g., the title section of your profile had an arbitrary length size in the input box but not their database, which was an unrestricted VARCHAR (or equivalent), if you removed the maxlength attribute of the input you could put paragraphs of text in it and it would happily destroy the layout to display it all.