4 ms·
received email with password in plaintext after registration
by gondo 12y ago
received email with password in plaintext after registration
- rabble 12y agoI was just going to say the same thing. What the hell kind of group offers security and VPN services and then sends passwords plaintext!
- Someone1234 12y agoThey will need to store them in plain text or encrypted plain text (which is just plain text with sugar on top) just due to the way some of the VPN protocols they support work. They should avoid emailing them however, if they can.
- deleted 12y ago[deleted]
- sgdesign 12y agoNot sure if it's relevant here, but I want to point out that just because you received it in plaintext doesn't mean they store it in plaintext. So if you change it immediately to something more secure, and it might not be a security risk after all.
- sp8 12y agoThat isn't the point, if they can send it in plaintext then they have it in a recoverable form. They shouldn't be storing your password at all. They should be storing a hash of your password. And on top of all that, sending it plaintext via email, itself a largely open format, means they've broadcast it to all kinds of other potentially bad actors. Plus it indicates (to me) a questionable grasp of security, not a great sign for a VPN provider. Its just wrong.
- Karunamon 12y agoIt could very well just mean that the email is sent before any hashing occurs (as part of the registration controller, in other words) - but yeah, you're right, considering that email's physical equivalent is a postcard, it shows a tremendous lack of respect for the user. Kiss of death for a supposedly privacy focused operation like a VPN provider.
- odonnellryan 12y agoLooks like you set the password originally, then they send THAT password plaintext. It'd be acceptable if it was a random password generated for email-auth reasons. Not acceptable if you're setting the password.