Timeline for Is HostGator storing my password in plaintext?
Current License: CC BY-SA 4.0
17 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 29, 2019 at 22:42 | comment | added | Joshua | @ConorMancone: If he says it is and is saying it without any knowledge to make the customer happy he is still lying. | |
| Mar 28, 2019 at 12:28 | comment | added | Darrick Herwehe | FWIW, I think this is a good answer that both assumes that everything in the chat log is true while still concluding that it's bad security. | |
| Mar 28, 2019 at 9:03 | history | edited | Kolappan N | CC BY-SA 4.0 |
added 227 characters in body
|
| Mar 27, 2019 at 22:57 | comment | added | Kolappan N | @corsiKa Exactly why I say transmission is the bigger problem here. That's why I list asking the company to stop sending passwords as the first step of action. | |
| Mar 27, 2019 at 19:00 | comment | added | corsiKa | @KolappanNathan I would argue that even if he did ask for it, a responsible company would have said "No, we're not emailing you a password. It isn't possible, and even if it was possible (for example when you first signed up) we still wouldn't." | |
| Mar 27, 2019 at 13:08 | history | edited | Kolappan N | CC BY-SA 4.0 |
added 152 characters in body
|
| Mar 27, 2019 at 13:03 | comment | added | Kolappan N | @ConorMancone The OP said that he received the password in email when he did not ask for any. He could have abandoned his email. I consider transmission to be biggest issue. I agree with the fact that encrypting passwords is insecure too. No disagreements there. | |
| Mar 27, 2019 at 12:59 | comment | added | Conor Mancone | @KolappanNathan When it comes to plain text offenders it doesn't really matter if it is literally plain text or encrypted - the two are just as bad when it comes to security. As per the typo, it isn't actually a typo because they misspelled two different parts of the word. I actually think that has significance - if they misspell the word that badly, I think anything they say about the topic should be ignored. Regardless though, my biggest disagreement is about your statement regarding transmission vs storage | |
| Mar 27, 2019 at 12:57 | history | edited | Kolappan N | CC BY-SA 4.0 |
added 434 characters in body; deleted 1 character in body
|
| Mar 27, 2019 at 12:40 | comment | added | Kolappan N | @ConorMancone That is possible and an answer already exists for such a possibility. My answer deals with an another possible scenario that the password is encrypted. It is a possible scenario. No one can tell for 100% percent that the password is in plain text. What is wrong about writing answers for an another possible scenario? The typo does not indicate anything. He misspelled a single letter!!! | |
| Mar 27, 2019 at 12:33 | comment | added | Conor Mancone | Also, I would say that the method of storage is the bigger concern here. Most passwords get leaked because someone gets a hold of them at rest. Hacking accounts by intercepting emails with plain-text passwords is substantially less common, almost by definition (because you can only MITM emails one at a time, but if you hack a server you get everything). | |
| Mar 27, 2019 at 12:30 | comment | added | Conor Mancone | "Assuming he is telling the truth" implies he is either truthful and correct or lying. The reality is likely a third option: he doesn't actually know the answer and, like many reps, is simply trying to make the person on the other end happy. Never attribute to malice what can easily be explained by ignorance. The fact that the rep doesn't even know how to spell encryption (the way they spelled it clearly wasn't the result of a simply typo) is a strong indication that they are simply ignorant of this topic and don't know anything about it. | |
| Mar 27, 2019 at 12:26 | comment | added | Beofett | @KolappanNathan There's a difference between "there's little reason to assume that rep is a trustworthy source" and "I know he does not know what his company is doing". But if a (presumably tier 1 or sales) support person says something that contradicts basic security practices, why would you take the chance that that's the only thing they got wrong? | |
| Mar 27, 2019 at 12:23 | comment | added | Kolappan N | @Beofett He is not aware of the security risks involved in what his company is doing. But how does it mean that he does not know what his company is doing? I am not telling that you should trust him, but there is a possibility that it is the truth. | |
| Mar 27, 2019 at 12:21 | comment | added | Beofett | @KolappanNathan Given that that same employee considers sending passwords via email to be a safe practice, there's very little reason to assume that rep is a trustworthy source of information. | |
| Mar 27, 2019 at 12:10 | comment | added | MindSwipe | "No, the company representative explicitly told that they are not storing the password in plain text" since when can you blindly trust what a low level rep says about a large company? | |
| Mar 27, 2019 at 9:41 | history | answered | Kolappan N | CC BY-SA 4.0 |