3 ms·
You are also listing websites that send you your password when registering or changing password. I am not sure that's appropriate. I know systems that send you
by runn1ng 12y ago
You are also listing websites that send you your password when registering or changing password.
I am not sure that's appropriate. I know systems that send you the mail with your password after registration/password change and then save the passwords to database hashed.
You cannot deduce that they save passwords in plaintext because they send you the password after registration/password reset.
Example:
http://plaintextoffenders.com/image/89463394135 http://plaintextoffenders.com/image/89463394135
- omervk 12y agoYes, this is also explained in a link from our About page here: http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in http://plaintextoffenders.com/post/7006690494/whats-so-wrong... TL;DR - it's still a security issue (albeit smaller), we've included it in our mandate, please don't do it.
- lyndonh 12y ago> If someone were to hack into any mail account, all they need to do is search for ‘password’ and they have all of the user’s passwords. Only if you're dumb enough to not delete any password emails. Granted, preferable any site sending you your password in an email should either send a reset link or "your password is 'red*'"
- icebraining 12y agoOnly if you're dumb enough to not delete any password emails. You delete it from your MUA, but how can you be sure that it wasn't stored in any of the intermediate servers?
- lyndonh 12y agoThe natural assumption is that the hacker has got your password, not hacked gmail or hotmail, etc.
- deleted 12y ago[deleted]