Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a company sends me a new password via SMS/email because I clicked "forgot my password." Does that mean the company is not actually hashing my passwords?

share|improve this question

marked as duplicate by D.W., Mark, Graham Hill, TildalWave, Iszi Aug 20 '14 at 14:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

@Xander No, it's completely different if the site sends a new password and not the existing one. – Gilles Aug 14 '14 at 19:34
@Gilles Yes, which both this question and the accepted answer on the other seem to be referring to. – Xander Aug 14 '14 at 19:38
@Xander Oops, I was misled by the title. But it's yet another different situation: sending the just-entered password, not a new password. Sure, the answers stem from the same principle, but it's not the same question. – Gilles Aug 14 '14 at 19:40
up vote 8 down vote accepted

If they are indeed sending you a new password (i.e.: a system-generated password other than the one you previously had) when you click 'forgot my password' then no, that doesn't mean they're not hashing passwords. They can have their forgot password function generate a password, hash it and store it in their database, and then (while it's still in memory) generate an email that includes the plaintext value.

share|improve this answer

I have not encountered a site that actually sends a new password in years. What they do is send a password reset link that expires fairly soon. The lengthy character string won't be brute-forced anytime in this universe but is simply matched (and expiry time checked) to allow you to enter a new password of your choosing. Good sites will do that on an SSL page.

An attacker would have to compromise either the outgoing mail from the site or your incoming mail, probably easier to go another route.

share|improve this answer
Some sites will generate a random password, send it to you via email and set a flag on your account that forces you to change your password on next login; similar to how an IT administrator would do if you forgot your user account password. – sleblanc Aug 15 '14 at 2:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.