Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The password was not partially replaced with *s or similar; it was the naked, blank password I picked.

This does mean people who can check the emails the shop sends could theoretically see my login data, does it not? I believe this is the first time I get a confirmation with my full login information so this seems really weird and somehow concerns me. Should it?

From the fact that I received my password by email, I am guessing that the shop does not encrypt my password. Is this a valid inference?

share|improve this question
7  
I wouldn't imply that they don't encrypt your password, I have seen quite a lot sites who send the password out at the registration, even when I dislike that concept. They will take the input -> validate -> send mail -> encrypt -> save. That way you got a confirmation what you have entered. –  D. Schalla Jun 17 at 8:33
    
But I should ask them if they do, shouldnt I? –  Alex Jun 17 at 8:34
1  
Uhm, well, you can. You could also take a seperate password which you don't use anywhere else. –  D. Schalla Jun 17 at 8:35
6  
10  
Don't forget to add the site to plaintextoffenders.com –  JSmyth Jun 17 at 18:16

4 Answers 4

up vote 35 down vote accepted

Sending you the password in plain text does not necessarily mean the database stores it in plain text, especially if they sent you the email before encrypting and storing the password. However if you ask for the password later on (e.g "forgot password" mechanism) and they do send it to you like this, it implies that they are either storing in plain text or they're using an easily reversible encryption. In either case, there is reason to be concerned unless they only send you the password on registration and before storing it on their server in encrypted format.

In particular:

  • If they have a "forgot my password" link that sends you the password you had previously set up, then yes, there is reason to be concerned: they are storing the password in plaintext or using reversible encryption.

  • If they send you a new password, then it doesn't necessarily mean they are storing the password in plaintext or using reversible encryption. In that case, you don't have enough information to know whether there is cause for concern.

A separate issue is that, in any case, email is not a safe medium for sending passwords. Thus, even if they aren't storing the password in plaintext, if they are sending it to you by email in plaintext, that does pose some risk.

according to plain text offenders:

Man in the middle attacks are easy to pull off between server and the comminucation protocol in itself is not encrypted.

share|improve this answer
    
thanks for your answer, I will ask them –  Alex Jun 17 at 8:42
    
There are a lot of shopping sites on the internet nowadays and a lot of them are not officially recognized and certified. Best thing to do is (as you mentioned yourself) not to use your main password and also use secure payment methods like paypal. –  Abbas Javan Jafari Jun 17 at 8:48
6  
You're right that this doesn't necessarily mean they aren't encrypting the password on their own servers (as they might be sending the mail before storing it), it's still a security concern as your password is still being stored in plaintext (on an unknown number of unknown servers between the sender and your inbox!) –  Iain Galloway Jun 17 at 12:23
    
Very true, thanks for pointing it out –  Abbas Javan Jafari Jun 17 at 13:21
1  
I'd prefer if they did store the password in plaintext but didn't sent it by email; for the same reason that I'd prefer to write my phone number on a piece of paper instead of shouting and spelling every digit more than once inside a mall, when giving it to someone else. –  Bakuriu Jun 17 at 15:57

Shops should not send passwords over email. One of the reasons is an answer to one of the questions:

yes, people who can check those emails their shop sends could theoretically [still yes if you leave that word out] see my login data.

Man in the middle attacks could also be successful if the shop uses httpS, but accepts http just as well, see bank advice in Netherlands.

share|improve this answer

Well, just because they sent you a plain text password does not mean they don't utilize cryptography when storing your password.

First of all, within cryptography there are hashes and encryption. They should neither encrypt nor store your password in plaintext. They should hash it.

Encryption Function: a two-way function which transforms data in a way which is difficult/near impossible to reverse without knowing the decryption key (I won't bore you about key types).

Hash Function: a one-function which transforms data to a unique signature with which it is seemingly impossible to determine almost anything about the original data (length, text entered, etc.). Hashes are impossible to reverse and can only be discovered by brute-forcing/rainbow table. Brute-forcing is infeasible even with massive amounts of computational power. Rainbow tables can be thwarted if the website uses what we call a "salt" when generating their hash.

So, the website should not even store your password encrypted, but they certainly should not store it in plaintext.

However, what could be happening here is simple. When you register, the script that's called might automatically hash your password, add the hash to the database and, within the same instance, dispatch the email using PHP's mail() function. By using this function, the plaintext password would never actually get stored within an 'Sent Mail' folder because the mail() function doesn't use an established email to send from.

Sending the password in plaintext to the user via e-mail is still very insecure, but this doesn't necessarily mean that they don't store it on their end securely.

Shortened Version:

I know that was long-winded and technical, but the short version is that when you register, they might e-mail it plaintext then, but then store it securely in an irretrievably fashion. It's still a security flaw, but, if they do this, it's not as big of a concern. Just because they send it as an e-mail doesn't necessarily mean it's stored in a 'Sent Mail' folder.

share|improve this answer
    
they actually save it encrypted, it is magento. but sending the plain text password via email just really semed awkward. thanks for your answer! –  Alex Jun 18 at 7:48
    
It is as big of a concern. it's a bigger concern. Sending the password plaintext in an email is worse than storing it plaintext on the server. Depending on how well the rest of the server is set up, that plaintext file can at least be made rather difficult to lay hands on, but the nature of the email protocol precludes a similar level of difficulty in reading your messages. –  Matthew Najmon Jun 18 at 11:24
    
@MatthewNajmon Yes, it is worse to send the password plaintext over email than to store it plaintext in a database (arguably), but what's worse than that is to both store it on the server plaintext and send it plaintext. If they do both, that is the worse scenario. That being said, one could argue that sending it via email is better and storing it hashed is better because an attacker would only get passwords obtained via MiTM whereas if the attacker used SQLi, he would would obtain every password even those which were set up before MiTM. Regardless, it's a bad system with possible bad outcomes –  Spencer Grant Doak Jun 19 at 15:58
    
@Alex, I'm certainly glad to hear that at least the storage is secure, but I would be leery about any site that emailed me my password for their site. –  Spencer Grant Doak Jun 19 at 16:04
    
yep, it feels weird –  Alex Jun 20 at 8:00

Ok - many good answers here on plaintext-passwords, hashs and storage...

But the single most compelling concern is:

E-Mail is usually not a safa way of transmitting data. It is probably about as safe as you shouting a message across the street, where someone will hear it and repeat it in the direction you specified as the target address...

No matter how safe their server is, with E-Mail you have usually no encryption in sending them and in many cases no authentication. So there is a bunch of man in the middle attacks to get the content of that E-Mail, which is most likely stored and parsed on its way by various virus/spam scanners, advertisment analysis and who knows what tools... The content of the E-Mail, including your plaintext password could be flying around on countless machines of a spam-scanning or text-indexing cloud network...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.