Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received the password in my e-mail in plain text.

I would imagine that to make this possible, the password would have to be stored in plain text somewhere in the database. Is this necessarily true?

share|improve this question
18  
Yes! Yes! Yeeeeeeeeeeeeesssssssssssssssss! –  ewanm89 Oct 29 '12 at 22:27
4  
They could encrypt (probably aren't though) it in the database, but a decryption key is going to be available to that server. Finally, an email on the wire is not secure. –  ewanm89 Oct 29 '12 at 22:28
10  
plaintextoffenders.com –  Mormegil Oct 29 '12 at 22:37
    
I applied to become a graduate InfoSec consultant and this happened to me! I quickly revoked my application! –  LukeJenx Oct 30 '12 at 11:47
    
Out of curiosity, are you getting your password back in plaintext? Or is it a new password? –  Randy E Nov 1 '12 at 22:22

4 Answers 4

up vote 26 down vote accepted

Yes you should be concerned if you use the password on other websites or have personal data stored on it. This is one of the reasons you have to have different passwords for every website. They are storing your password plain text. I'd stay away from with personal data. It's one of those basic security principles they violated, chances are that there will be more.

share|improve this answer

You should be concerned only if you care about other people accessing your account on that site. Not only because they're storing your password in plaintext in their database, and not only because they've sent your password in the clear via email, but also because they obviously don't care enough about securing your account to make even a minimal effort.

What you should do in such a case is report them to http://plaintextoffenders.com/. This is a Tumblr site which collects evidence that various sites store passwords in the clear. The goal of this site isn't just the LULZ, but also to warn users of this issue and to shame the sites into mending their ways.

share|improve this answer
1  
Some of those aren't necessarily storing passwords in plain text. Just because you e-mail the password upon registration (which I'm not claiming is a good idea) doesn't mean you're storing the plain text password in the database. –  Snuffleupagus Oct 30 '12 at 14:04

Yes, you have to. If a tool can send your password, it means that your password is stored somewhere in a format, which is finally human-readable. Don't trust in that application or system.

share|improve this answer

Well, it depends. If they email you a new password instead of your old one, then its secure but if they email you your own password then you have to be worried!

share|improve this answer
    
In either case the password is being transmitted in plaintext which is the core of esqew's question. –  Scott Pack Nov 1 '12 at 20:53
    
@ScottPack yes, that is right, but my answer was intended for the 2nd part: "I would imagine that to make this possible, the password would have to be stored in plain text somewhere in the database. Is this necessarily true?" –  Afaan Bilal Mar 7 '13 at 7:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.