4 ms·

No problem here? It goes through so many servers, unencrypted…

gpvos 12y ago
It's no problem, as long as it's a one-time-only password and has a limited lifetime (ideally only a day or so). It's similar to a password reset URL, which is also a password equivalent, but only usable once. At least it's better than asking for your mother's maiden name.
- deleted 12y ago
  [deleted]
rimantas 12y ago
Well, what would you do with an encrypted password sent to you by email? How do you propose to solve this? Using password reset links instead changes very little.
- __david__ 12y ago
  > Using password reset links instead changes very little. Actually it changes a lot. Password reset links are one time only, and they get sent before you change your password. Mailing your password in plaintext after you've just changed it means it's good even if someone gets a hold of it months or years later. That's significantly worse.
  - joesb 12y ago
    Password can be one time password, too. Require user to change their password the first they login is not an advance feature.
    - __david__ 12y ago
      Of course they can be, but that's not what we're talking about here. Please read the ancestor comments.
fooyc 12y ago
Odds are that you registered over plain HTTP anyway
personZ 12y ago
How many servers does it go through? Mail in the real world, today, is virtually always source server -> destination MX server. There was once a fanciful era when occasionally offline servers passed off to various smarthosts, and this was the big fear about email, but that is no longer the case. HN passwords are not high security. If we lose an HN account, not only can it be easily restored by an admin, it's really not a huge loss - start again. There doesn't need to be extreme practices. Oh, you use the same password across sites? (which is the source of 99% of password security concerns). That is crazy, and you shouldn't do that. That's on you. (You being the conceptual person up in arms)

gpvos 12y ago

It's no problem, as long as it's a one-time-only password and has a limited lifetime (ideally only a day or so). It's similar to a password reset URL, which is also a password equivalent, but only usable once. At least it's better than asking for your mother's maiden name.

deleted 12y ago
[deleted]

rimantas 12y ago

Well, what would you do with an encrypted password sent to you by email? How do you propose to solve this? Using password reset links instead changes very little.

__david__ 12y ago
> Using password reset links instead changes very little. Actually it changes a lot. Password reset links are one time only, and they get sent before you change your password. Mailing your password in plaintext after you've just changed it means it's good even if someone gets a hold of it months or years later. That's significantly worse.
- joesb 12y ago
  Password can be one time password, too. Require user to change their password the first they login is not an advance feature.
  - __david__ 12y ago
    Of course they can be, but that's not what we're talking about here. Please read the ancestor comments.

fooyc 12y ago

Odds are that you registered over plain HTTP anyway

personZ 12y ago

How many servers does it go through? Mail in the real world, today, is virtually always source server -> destination MX server. There was once a fanciful era when occasionally offline servers passed off to various smarthosts, and this was the big fear about email, but that is no longer the case. HN passwords are not high security. If we lose an HN account, not only can it be easily restored by an admin, it's really not a huge loss - start again. There doesn't need to be extreme practices. Oh, you use the same password across sites? (which is the source of 99% of password security concerns). That is crazy, and you shouldn't do that. That's on you. (You being the conceptual person up in arms)