Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain text. I presume this means that they have stored my password in plain text.

Is there anything that I can do to either improve their security or completely remove my details from there system?

UPDATE: Thanks to everyone for their advise. I emailed them, spelling out what was wrong and why, saying that I will be writing to the DP commissioner and will be adding them to plaintextoffenders.com.

I got a response an hour later: an automated message containing a username and password for their support system. Oh dear...

share|improve this question
10  
And for added bonus points, what to do when the owners of the system claim/state that it's Industry Standard to do so? –  Jon Feb 3 '12 at 0:00
    
just do not use your favorite password tyrFTgjh432#@@ on unknown (any) sites. They can do not send your password in plain text, but still store it in plain text (view, sell...). –  garik Feb 13 '12 at 19:59
    
    
A bit late, but this is relevant: troyhunt.com/2012/07/lessons-in-website-security-anti.html –  paraxor Jul 4 '13 at 12:02

12 Answers 12

up vote 35 down vote accepted

There isn't really much you can do, other than contact the website and try and explain them how bad of an idea and practice it is to store (and email) passwords in plain text.

One thing you can do is report any offending site to plaintextoffenders.com - a site (currently a tumblr blog, but we're working on a proper site soon) which lists different "plain text offenders" - sites that email you your own password, thus exposing the fact they either store it in plain text, or using a reversible encryption, which is just as bad.

With everything that's happened with Sony, again and again, people become more aware to the dangers of sites storing sensitive details unencrypted, yet many still aren't. There are over 300 sites reported, with more reports coming every day!

Hopefully, plaintextoffenders.com helps by exposing more and more sites. Once this gets enough attention on twitter or other social media, sometimes sites change their way, and fix the problem! For example, Smashing Magazine and Pingdom have recently changed the way they deal with passwords, and no longer store nor email the passwords in plain text!

The problem is awareness, and I hope that we help the cause with plaintextoffenders.

share|improve this answer
4  
As I am based in the UK would I be able to suggest that they are in breach of the data protection act? –  jamesj Sep 13 '11 at 19:04
    
@jamesj: I really don't know, unfortunately! –  Igal Tabachnik Sep 13 '11 at 19:07
    
Nice idea with this site! Once you move to a proper site (or even before, if possible) you could add a section of "converted offenders". I hope that such a section would not stay empty and be an additional incentive for sites to fix their problems. –  Joachim Sauer Sep 14 '11 at 6:03
1  
@jamesj IANAL, but it looks like it may breach the seventh principle (see "accidental loss" in 9a). –  deizel Sep 14 '11 at 12:08
    
@jamesj - it's certainly worth letting the DP commissioner know; try to write a short clear easy to understand letter (on real paper) for them. Don't expect too much though. :-( –  DanBeale Sep 14 '11 at 18:47

Storing a password in plaintext is not really an issue -- at least, much less so than sending the said password in a plaintext email !

This email just proves that the web site administrators are not very careful with the information you entrust them with, and that's a good reason not to entrust them with any more data.

share|improve this answer
    
Can you elaborate a bit on why it's not an issue? I (along with millions of others) have a strong pwd that I use for many things. If everyone is doing their job and hashing then should I have to worry about my PWD being in plaintext and a disgruntled employee seeing it and using it to get into any one of my many accounts (My bank/other important passwords are different because of this). But making passwords visible to anybody seems like an issue and I'm curious as to why you say it's not because you are in fact the resident expert :) –  Dan Drews Apr 16 at 16:54
3  
As I said, it is less an issue than the sending out as an email. But this highlights the need for site-specific passwords. I never use the same password for two distinct services -- and you should do the same, because you cannot know how (in)competent the sysadmins of any site are. They may store the password in plaintext, or, even worse, send it by email to poorly validated addresses. –  Thomas Pornin Apr 16 at 17:13

Use a different password for each site. That way, when the password is compromised (whether by snooping on plaintext email transmissions, or even if a database with properly hashed/salted passwords is cracked), the attacker will only be able to access your account on that one site, rather than on all sites on which you have similar account credentials.

...and so you don't have to remember a zillion passwords: Stanford's PwdHash is a handy browser extension that automatically generates unique passwords by hashing a common password you enter with the site's domain.

share|improve this answer
    
See also the similar supergenpass options: Is the Bookmarklet Password Generator from SuperGenPass.com safe to use? - Stack Overflow –  nealmcb Sep 14 '11 at 20:04

That's why it's recommended to use another password on each site.

Try to e-mail them to delete your account. Otherwise do not use that site and really, use/generate another password (and long one!) on each site you're registering to. You never know which ones store plain passwords into their database

share|improve this answer
    
+1 For recommending unique passwords on each site. –  Mox Sep 15 '11 at 1:25

Send them one email asking to be removed from their database.

Don't give any more information about you to them

Be sure to not have that password used anywhere.

share|improve this answer
    
I have the feeling that anyone so negligent about security would, at the most, mark your database entry as inactive. I don't see any way to have assurance that your plaintext password is no longer available to all and sundry--the easiest way would probably be hacking in and deleting it. –  user502 Sep 13 '11 at 18:32
    
perhaps changing the password a thousand times, just in case it's stored somewhere to prevent that "don't repeat your last 3 passwords" –  woliveirajr Sep 13 '11 at 18:52

I would say since the password is out there for the world to see, just update it to a password that you are not using anywhere else. Thus no one can hack your information on any other site using the password on this site. Example could be if your email is your login and you are using the password on this site as a password for your email.

Other than that,if you would like to offer to help the website with storing passwords effectively and send them the link of this stackoverflow thread.

share|improve this answer

If it's transmitting passwords in plain-text, it's a "vulnerability".

The first step is to find proof, such as by running Wireshark to capture the passwords as they are sent on the wire.

The second step is to contact the company, such as by sending e-mail to "secure@example.com". The email addresses "secure@" and "security@" are the email boxes companies set up if they are concerned by such discoveries.

Save the responses you get from the company.

When it becomes obvious that the company isn't going to fix it, then post a message to the "full-disclosure" mailing list. Succinctly describe the problem, show the proof, and show the response.

Read email postings to the full-disclosure list in order to see how other people have done this.

share|improve this answer
  1. Don't use a system you can prove is insecure if you need it to be secure.
  2. Contact the company/owner responsible for developing the system and share your proof of its insecurity.
  3. If you get an unfavourable response from the company/owner that amounts to them being unwilling to correct the system to be secure to your satisfaction, move to another system.
share|improve this answer

What are best practices in dealing with that system :

Don't use that system with sensitive information. Consider what would the problems for you if there is some data leakage, or if someone begins to use the system with your login. If it's a no-go situation, stop using the system.

[best practices in dealing] and the owners of that system :

Register your insatisfaction using email and any other means of contact: customer support, phone call, contact emails, foruns, blogs, wikis...

while minimizing risk to yourself via the use of the system :

if you consider that you will use that system anyway, then don't use the same password for that system and any other system. If you can not use your email as a login, even better.

or reporting of the related issues?

the same other answers have told you: register all your complain, stop using it.

share|improve this answer

Changing the password has been suggested already. Changing it to "do not store passwords in plain text, you lamers!" and then e-mailing them asking to remove your account and delete all personal data might help your message being heard.

Apart from that, passwords in plain text are not that much of an issue since even hashed password databases can be bruteforce-attacked in a reasonable amount of time nowdays, especially if the hashed data does not contain any salt.

share|improve this answer

What's the difference between storing and emailing a plaintext password and emailing a unique link to a page to reset your password when you forget it?

I guess if you use the same password on a different site it could mean a hacker can get into your other accounts. Or if they break the whole site and get hold of the database, and even then, what's to stop them getting the salts used in encrypting your passwords.

Sending the passwords in plain text (or containing a unique link to a reset form) over email makes no difference to their ability to get into the site if the hacker has access to your e-mail. You're basically screwed unless the site has a policy of only snail mailing you passwords when you forget them, or requires an authentication token such as the chip-and-pin devices banks now require.

share|improve this answer
1  
A password reset link can be configured as single-use. If the legitimate user clicks it first, an attacker won't be able to use it. The link can also expire, in case the user doesn't receive the message. –  Jonathan Feb 6 '12 at 18:32
    
True, but if someone is targeting you it makes no difference. If they're snooping your email traffic or have access to your mail box in any other way (which is the premise here given we're talking about sending mail in plain text), they just have to press "I've forgotten my login" and they'll be in before you even know you've got the mail. It doesn't matter that it times out or is single use, they wont press it until they are already snooping your traffic and they'll follow the link straight away. The only secure thing to do would be to lock the account and snailmail a link/unlock code. –  fwgx Feb 8 '12 at 8:34
    
For completeness, here's this question on its own, with a good answer: security.stackexchange.com/questions/13026/… –  Aseem Kishore May 30 '12 at 14:29

There is nothing wrong with storing plaintext passwords. In fact, in some ways it is the best solution.

[not] storing passwords in plaintext limits the security of communications.

it is more secure to send passwords encrypted over the network, and store them in plaintext on the database, than sending the passwords in plaintext over the network and store them encrypted on the database.

In other words, the server needs to know the user password to support the most secure authentication mechanisms.

source: ejabberd Book, chapter Store passwords in plaintext in the database for security (link)

share|improve this answer
    
Message to downvoters: don't just downvote, say why you do not like my answer. Storing passwords in plaintext is a good and common practice in the Jabber world. –  user7610 Dec 8 at 16:03
    
If this is specific to a product, the answer should say so. Otherwise, this is a dangerous and misleading answer to put here. Storing it as a plaintext is never more secure than storing it hashed. Working around a limitation of a product is not being more secure in general. –  Chris Murray Dec 8 at 17:22
    
Further, the person who wrote that "book" (rather, an FAQ on a website) doesn't seem to understand security, or the importance of hashing passwords. No competent programmer (with an understanding of security) would advocate either plaintext or encrypted storage of passwords. –  Chris Murray Dec 8 at 17:26
    
@ChrisMurray Plaintext gives you the possibility to upgrade your authentication scheme if something better becomes available. Sometimes you are not able to perform the upgrade if you have stored is the hash. Then you have to keep using the old, less secure authentication scheme. –  user7610 Dec 8 at 20:01
    
@ChrisMurray In addition to that, plaintext gives you the flexibility to use multiple auth methods for different things. Let's say that I want to authenticate visitors on my webpage with HTTP Digest. I need to have plaintext passwords for that. –  user7610 Dec 9 at 9:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.