Timeline for Is HostGator storing my password in plaintext?
Current License: CC BY-SA 4.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 2, 2019 at 1:03 | comment | added | Peter Cordes | @forest: you're welcome :). And yeah, exactly my thoughts. For sophisticated readers like ourselves, we know the distinction is not really relevant, but the minutiae are actually important here in the context of figuring out which parts of the OP's email exchange are technically true or not. (The specific question, not just the general problem pointed out by the question.) So the commenters did have a good point. | |
| Apr 2, 2019 at 0:54 | comment | added | forest | @PeterCordes Thank you for the edit. I was using the terminology that Plaintext Offenders used, meaning that the data is effectively plaintext. You are completely right though that it could in theory be technically encrypted while still effectively plaintext, and we can't know if that is the case. | |
| Mar 29, 2019 at 23:31 | comment | added | Gruber | @LightnessRacesinOrbit ups nice catch, can't understand how I missed that! | |
| Mar 29, 2019 at 11:12 | comment | added | Lightness Races in Orbit | @Gruber No. OP says it was their password from a year ago, not a new generated password. | |
| S Mar 29, 2019 at 8:02 | history | suggested | Peter Cordes | CC BY-SA 4.0 |
Add weasel words to cover the case of encrypting (instead of hashing) their DB: not literally plain text, but equivalent as far as them being able to recover user's passwords. This was brought up in comments.
|
| Mar 29, 2019 at 4:35 | comment | added | Gruber | I'll be extremely naive: couldn't they have picked a random string, saved the hash, and automatically emailed that same string? (I repeat this is a naive speculation, OFC this is NOT a proper way to handle the process as they could have logs/email/whatever with that string as plain text stored somewhere). | |
| Mar 29, 2019 at 2:54 | comment | added | Peter Cordes | @GregSchmit: that's fair. I left a suggested edit to add "or equivalent" to make this answer not wrong. The top answer already covers the details of the distinction, so we don't need to repeat that here, just use some weasel words. | |
| Mar 29, 2019 at 2:53 | review | Suggested edits | |||
| S Mar 29, 2019 at 8:02 | |||||
| Mar 29, 2019 at 2:35 | comment | added | Greg Schmit | To reiterate (because apparently this needs to be done), I agree that encrypting passwords is bad practice, since that means that they can be decrypted, but this answer dishonestly pretends that it's been proven that they store passwords in plaintext when it's plausible that they store them encrypted, and the highest-voted answer correctly addresses this. | |
| Mar 29, 2019 at 2:30 | comment | added | Greg Schmit | @PeterCordes I disagree, because the password was in the email, which implies (without having with ask) that they store passwords in a way that they can retrieve them (either plaintext, or encrypted). The highest voted question addresses this by first stating that it's a problem, but that it isn't known whether this means they are stored encrypted or plaintext, and this answer (incorrectly) assumes that it has been proven that they store passwords as plaintext. | |
| Mar 29, 2019 at 2:07 | comment | added | Peter Cordes | @GregSchmit: I read the OP's question as "am I crazy / missing something, or does this evidence really mean that they're storing plaintext-equivalent passwords?" Maybe the OP missed the semantic point that recovering plaintext with a known key is different from storing in plaintext, or maybe they know it's basically just as bad and glossed over that. This definitely answers the main thrust of the question, that escalation is probably pointless because they're still doing the same bad thing they have been for years, and it's presumably been pointed out to HostGator before. | |
| Mar 28, 2019 at 20:40 | comment | added | Greg Schmit | @BenVoigt Ok, that's true. I would just suggest that if the OP was asking that question, it would be worded differently. I think it's clear they were asking whether the company was storing the passwords in plaintext in the database. | |
| Mar 28, 2019 at 20:30 | comment | added | Ben Voigt | @GregSchmit: Why can't OP ask a question he already knows the answer to? That's Socratic method. The goal is not to learn the answer, it's to make the other person aware of the problem. | |
| Mar 28, 2019 at 20:29 | comment | added | Greg Schmit | @BenVoigt We already know for a fact that the plaintext password was emailed, so that's irrelevant. The question is whether they are storing that in plaintext in their database. The OP wouldn't have asked "is this password stored in plaintext on an email server somewhere", because that would be a stupid question to ask given that the password was emailed. | |
| Mar 28, 2019 at 20:24 | comment | added | Ben Voigt | @GregSchmit: Regardless of whether the password is stored plaintext in the auth database, it is stored plaintext in HostGator's e-mail server, potentially transmitted in plaintext across the Internet, and potentially stored plaintext at the recipient e-mail server. I say potentially because it largely depends on the domain where you receive your HostGator e-mail and how the server handling that domain is configured. | |
| Mar 28, 2019 at 18:08 | comment | added | Greg Schmit | And they claim, at least, that they don't store passwords in plaintext: i.imgur.com/9qrVPrm.png (again, not disputing that this is bad practice). | |
| Mar 28, 2019 at 18:05 | comment | added | Greg Schmit | I realize that this is a semantic point, but I don't see how this proves that they store passwords in plaintext. They could have them encrypted and are decrypting them when they send them to you. Of course this is bad practice. | |
| Mar 28, 2019 at 2:05 | history | answered | forest | CC BY-SA 4.0 |
