A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my password.
Is this a bad idea?
My thoughts are that, yes, it is, on the grounds that:
- If they are able to send me my password, does that imply that they're storing it unencrypted?
- Given that e-mails like these were sent specifically due to my inactivity, it's possible that I no longer use that e-mail account, which means that it could have been compromised since I last used it.
- Users frequently use the same passwords across multiple site. If e-mail is inherently insecure, revealing a password from one site in this way potentially compromises the user's accounts on other sites.