Reputation
1,027
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
5 20
Impact
~323k people reached

  • 0 posts edited
  • 2 helpful flags
  • 91 votes cast
Aug
16
revised Website sent me my new password (after reset) in clear text
added 255 characters in body
Aug
16
comment Website sent me my new password (after reset) in clear text
@Craig also fair enough. I guess I have gone off topic one too many times back in school and that must have stuck with me :P
Aug
16
comment Website sent me my new password (after reset) in clear text
@Craig lol this is not a challenge. I was merely pointing out that explaining how to implement password resets properly or how to harden the process does not answer the question of whether receiving the password in plain text means that this password is also stored in plain text.
Aug
16
comment Website sent me my new password (after reset) in clear text
@Craig Ok, in this case nothing is stopping you from generating a password, sending it to the user and then hashing it and storing it in hashed form. In both cases, I think this should be addressed to the developers as there is no way we can answer it ourselves.
Aug
16
comment Website sent me my new password (after reset) in clear text
A bit off topic I think. The first paragraph does not add anything that was not included in the other answer, while the others (while informative) do not answer op's question and are not related.
Aug
16
comment Website sent me my new password (after reset) in clear text
@Craig You could still do that by fetching the password as it is being input and as it ends up in the $_POST array (or equivalent), before hashing it. So both things can be really, but this fact does not automatically imply that they are also storing the password in plain text.
Aug
16
revised Website sent me my new password (after reset) in clear text
deleted 34 characters in body
Aug
16
answered Website sent me my new password (after reset) in clear text
Aug
16
comment How long before a key is visible on a key server?
@begueradj Yep, that seems to be it. The funny thing is that I can retrieve all keys if run a lookup from GPG Keychain, but not if I use the web interface.
Aug
16
asked How long before a key is visible on a key server?
Aug
5
awarded  Popular Question
Jun
27
awarded  Quorum
May
19
awarded  Popular Question
Apr
13
accepted If using a different password for every application is considered good practice, why is using a directory so widespread?
Apr
11
asked If using a different password for every application is considered good practice, why is using a directory so widespread?
Apr
4
awarded  Yearling
Jan
19
accepted OpenVPN bridging vs routing: which is more secure?
Jan
19
answered Is a VPN really secure at the VPN providers side?
Jan
19
comment OpenVPN bridging vs routing: which is more secure?
@schroeder the page you linked also states the following though: "Routing also provides a greater ability to selectively control access rights on a client-specific basis."
Jan
18
revised OpenVPN bridging vs routing: which is more secure?
deleted 247 characters in body