Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My city has online billing for utilities. When you set up an account they email your user name and password to you. You can't change your password without them emailing it to you again. Isn't this insecure? Doesn't that mean my user name and password is being sent in the clear and someone can log on to my account?

share|improve this question
3  
Some degree of public shaming is in order. Could you please tell us which city you live in? Also what does the account do - can you only view your outstanding bills via their website or can you also pay from it? –  rath Nov 30 '13 at 2:04
    
It is the City of Long Beach, CA. You can pay your bills from it. I emailed the general email on the website, but who I really need to get the message is the person in charge of the online billing system. Do you guys know how to do that? –  Sharon A Dec 1 '13 at 5:24
add comment

6 Answers

Yes this is correct. Security principles dictate that you should be able to set your own password.

share|improve this answer
2  
Thanks for your reply. I wonder if I can make them see the error of their ways. There's no way I can change my password without having them email it right back to me. They should do the thing where they email you a temporary password and then let you go and put in a new password on the site. It's hard to believe that they could be this lame when it comes to security. –  Sharon A Dec 1 '13 at 4:47
    
@SharonA: I already tried to contact a company that sent me back my forgotten password years after I registered, telling them it's absolutely not secured to store passwords in clear text. My email was obviously read by someone who was clueless about basic security measures, and who thus just told me not to worry, that everything was perfectly secured. Making it known through social medias may be more efficient to reach the correct person. –  user276648 Dec 6 '13 at 3:41
add comment

I will echo that this is very poor practice, but depending on your situation, it may simply be "poor" instead of "disastrous".

For example, if the billing information that you access with those credentials only shows power consumption for user number 3187987 for the current month (where that number is unique and unrelated to a person or address) then a breach doesn't reveal much sensitive information.

Some systems are deliberately designed with this in mind; we don't know if this applies to your situation.

I would encourage you to email your council and explain why you are concerned about the current situation (do let us know what they say).

share|improve this answer
1  
When I log into the account it shows my name, my address and my billing history. I wonder what kind if job they're doing keeping my financial information secure. –  Sharon A Dec 1 '13 at 5:37
add comment

Its definitely a bad practice. This means that there are no password hashing mechanisms in place and the application knows the passwords used by its users.

I would recommend not using the same password for your other online activities.

share|improve this answer
3  
It sounds like the password is only emailed when it is initially set, so we can't infer that it is stored in plain text, only that the server has a plain text version of it when it's initially set. –  davidwebster48 Nov 30 '13 at 9:49
    
The password is emailed to you every time you change it along with your user name. I use a password manager so I have a different password for all my different accounts. I suppose unsophisticated users would be even more at risk as they tend to use the same user name and password across many different websites. –  Sharon A Dec 1 '13 at 5:50
    
@davidwebster48 Hmm... you are right.When the OP said that he can not change his password without them emailing it again I thought its the forgot password feature that sends the original password when requested and hence I came to a wrong conclusion. Apologies. –  Shurmajee Dec 2 '13 at 10:54
add comment

An alternate solution, just to moderate all of this crying foul: the passwords are hashed and stored as being associated to usernames in the sever, and the answer to a "Security Question" (which we must assume exists) is used to hash the password. This is the solution to the main problem: passwords are hashed so that the server, which we must assume does not store the answers but simply sends the plaintext of the decryped password regardless of its correctness. Now, the hash wouldn't be very strong, but this would work. As to sending it via plaintext, there are a huge variety of things that someone could do to you if they read your e-mails, including, for instance, resetting your Paypal password (by using the password reset link themselves). Why on earth would they bother with reading your bills?

share|improve this answer
add comment

It is my understanding that, unless they are doing something to securely deliver the email to you, that they are effectively writing your password on a postcard and sending it out for any sniffers to see. Combined with the system having your PII (name, phone, address, ect.) and financial information, I would be concerned. And while it is an assumption, I would guess that other areas of security within this application will not be much better.

If you contact the general email asking for tech support help, you may be able to get to a person who will be able to contact the developer, who can then talk to.

share|improve this answer
add comment

Not being able to set your own password nowadays feels kinda weird. Is it because they don't trust users to use strong passwords, or is it because it's easier for them to generate it automatically? (I would think the latter)

As for sending the username and password by email, it's not the only website that does that just after registration. If later on you request your password and they send it to you again, it means they stored it in clear text. If on the other hand they generate a new password, it hopefully means they're not storing it in clear text.

If they are using HTTPS to send the email, and you're using HTTPS to read it, it should be safe right? (as long as of course they're not storing the passwords in clear text, and even better they're adding a unique salt to each account)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.