Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 10 down vote favorite

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my password.

Is this a bad idea?

My thoughts are that, yes, it is, on the grounds that:

  1. If they are able to send me my password, does that imply that they're storing it unencrypted?
  2. Given that e-mails like these were sent specifically due to my inactivity, it's possible that I no longer use that e-mail account, which means that it could have been compromised since I last used it.
  3. Users frequently use the same passwords across multiple site. If e-mail is inherently insecure, revealing a password from one site in this way potentially compromises the user's accounts on other sites.
share|improve this question

2 Answers

up vote 15 down vote accepted

  1. They are either storing it in plain text (likely) or they are using a reversible encryption. So in case of a compromise the password is at risk.

  2. Yes, and it is even worse: Some email providers such as Hotmail delete inactive email accounts and allow other people to register it. The upper management of Twitter was successfully attacked by re-registering an old Hotmail account.

  3. Yes, correct. A reused password, that was revealed in one of those mails, played an important role in the mentioned twitter attack.

share|improve this answer
Why do you think it is likely that the password is stored unencrypted? Because they are using poor security practices? Nice reference to an actual attack based on the OPs concern. – this.josh Jul 4 '11 at 4:40
2  
Hi @this.josh if they care so little about security to email the password to you they are not going to go to the trouble to use reversible encryption, they will just store it plain-text. – Andrew Russell Jul 4 '11 at 11:54
up vote 4 down vote

Hendrik has provided a great set of problems. In addition, even if the service operators use SMTP with TLS to submit the mail from their reminder-bot's MUA to their local MTA, they then have no guarantee and no way of knowing whether the content remains encrypted all the way to your MDA and MUA. In other words: they could be showing anyone your password, even if you receive the mail correctly.

[As an aside, mailman is a high-profile mailing list manager that still follows this dangerous process. And guess what mailing list manager is used on the OWASP mailing lists? :-(]

share|improve this answer
[Hendrik tries hard to stop giggling...] – Hendrik Brummermann♦ Jul 3 '11 at 19:50
additionally... The senders are sending security critical information in response to a non-security event. They are trading security risk for business risk (loosing users). – this.josh Jul 4 '11 at 4:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.