132

I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.

I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:

enter image description here

I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?

enter image description here

Improve this question
7
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop ♦
    Commented Mar 28, 2019 at 14:46
  • 10
    Bluehost too :( . When you contact bluehost customer service (any agent) throw emails or chat on web, they ask for the last 4 digits of your PASSWORD to proof t's you - the owner
    – AccountantM
    Commented Mar 29, 2019 at 9:38
  • I had JustHost for a long time until one day they asked me as a "security question" to tell them some portion of my password. He assured me that he "couldn't see my whole password" but could/would not tell me if they were storing in plain text. That was my last day as a customer. In both of our cases it's either plaintext or, as mentioned below, reversible; which is unnecessary and dangerous.
    – Gary
    Commented Mar 29, 2019 at 17:59
  • 1
    Passwords are only safe when stored encrypted by a one-way, salted, cryptographically secure hash. Whether stored plaintext or encrypted (and decryptable), you are one security incident away from access. The offenders are not going to fix it. Migrate to another provider, Fire them! ... and explain that their bad security practices are the reason.
    – ChuckCottrill
    Commented Mar 29, 2019 at 22:52
  • 1
    Note that another signal that the provider stores cleartext (or decrypts) passwords is when they prevent reuse of portions of previous passwords - how can they detect reuse without having the previous password in cleartext ;-)
    – ChuckCottrill
    Commented Mar 29, 2019 at 23:22

3 Answers 3

Reset to default
183

Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).

Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.

Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.

Improve this answer
13
  • 40
    That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
    – M -
    Commented Mar 27, 2019 at 0:07
  • 54
    You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
    – psosuna
    Commented Mar 27, 2019 at 0:26
  • 8
    I'd change the first sentence to "... if that was any user-provided password" to catch the broadest sense. Only autogenerated passwords that must be changed at next login are okay(ish) to transmit this way.
    – orithena
    Commented Mar 27, 2019 at 9:35
  • 15
    This answer could be stronger. The rep was completely wrong. Even if they are using reversible encryption so they can extract the original plaintext, that's about as good as not encrypting at all and he claims that email is secure which is total nonsense. This needs to be escalated with HostGator for the benefit of everybody.
    – Lightness Races in Orbit
    Commented Mar 27, 2019 at 13:37
  • 4
    Why do you say "in a pinch, bcrypt" - is it not just as secure as scrypt or argon2? It certainly has years of field testing.
    – corsiKa
    Commented Mar 27, 2019 at 18:55
82

Yes, they store passwords in plaintext or equivalent, and definitely transmit them in plain text. This was discovered in 2011.

This is confirmed HostGator being listed on Plaintext Offenders, as well as by its entry in the CVS file containing a list of offenders. This is not new and has been known since at least 2011. HostGator has not reformed since. The Plaintext Offenders website shows a screenshot similar to yours as evidence:

HostGator sux

Improve this answer
15
  • 12
    I realize that this is a semantic point, but I don't see how this proves that they store passwords in plaintext. They could have them encrypted and are decrypting them when they send them to you. Of course this is bad practice.
    – Greg Schmit
    Commented Mar 28, 2019 at 18:05
  • 3
    And they claim, at least, that they don't store passwords in plaintext: i.imgur.com/9qrVPrm.png (again, not disputing that this is bad practice).
    – Greg Schmit
    Commented Mar 28, 2019 at 18:08
  • 11
    @GregSchmit: Regardless of whether the password is stored plaintext in the auth database, it is stored plaintext in HostGator's e-mail server, potentially transmitted in plaintext across the Internet, and potentially stored plaintext at the recipient e-mail server. I say potentially because it largely depends on the domain where you receive your HostGator e-mail and how the server handling that domain is configured.
    – Ben Voigt
    Commented Mar 28, 2019 at 20:24
  • 7
    @BenVoigt We already know for a fact that the plaintext password was emailed, so that's irrelevant. The question is whether they are storing that in plaintext in their database. The OP wouldn't have asked "is this password stored in plaintext on an email server somewhere", because that would be a stupid question to ask given that the password was emailed.
    – Greg Schmit
    Commented Mar 28, 2019 at 20:29
  • 6
    To reiterate (because apparently this needs to be done), I agree that encrypting passwords is bad practice, since that means that they can be decrypted, but this answer dishonestly pretends that it's been proven that they store passwords in plaintext when it's plausible that they store them encrypted, and the highest-voted answer correctly addresses this.
    – Greg Schmit
    Commented Mar 29, 2019 at 2:35
4

If the company rep's response is true, the Password is stored as an encrypted text. This makes the plain text password in unprompted email a bigger concern.

is it safe to assume that my password is stored in their database as plain text?

The company representative explicitly told that they are not storing the password in plain text. Assuming that he is telling the truth, my conclusion is that they are storing the password in encrypted text. They are better than plain text passwords but they are still insecure. Hashing and salting is the best way to store passwords.

If the stored password is encrypted, the biggest concern here is not the way it is stored but the way it is transmitted, in plain text on an email when the user did not request any.

do you have any suggestions on how to address this issue with the provider?

You can ask the company to change the following (in the order of priority)

  1. Stop sending passwords over email.
  2. Provide Reset password option instead of recovering it.
  3. Replace encrypting passwords with Hashing and Salting.

In response to comments,

  1. Yes, there is high chance that the rep is lying or didn't know what he is talking about. But there is also a possibility that he was telling the truth. This answer deals with that scenario.
  2. I consider transmission of passwords as a bigger problem to storage because the OP was sent the password in an email when he did not ask for any.
  3. I have seen systems that store passwords in an encrypted text and send them to users upon request. They are not secure, but they do exist. Just because you received your info in plain text does not guarantee it is stored that way too.
Improve this answer
13
  • 50
    "No, the company representative explicitly told that they are not storing the password in plain text" since when can you blindly trust what a low level rep says about a large company?
    – MindSwipe
    Commented Mar 27, 2019 at 12:10
  • 41
    @KolappanNathan Given that that same employee considers sending passwords via email to be a safe practice, there's very little reason to assume that rep is a trustworthy source of information.
    – Beofett
    Commented Mar 27, 2019 at 12:21
  • 21
    "Assuming he is telling the truth" implies he is either truthful and correct or lying. The reality is likely a third option: he doesn't actually know the answer and, like many reps, is simply trying to make the person on the other end happy. Never attribute to malice what can easily be explained by ignorance. The fact that the rep doesn't even know how to spell encryption (the way they spelled it clearly wasn't the result of a simply typo) is a strong indication that they are simply ignorant of this topic and don't know anything about it.
    – Conor Mancone
    Commented Mar 27, 2019 at 12:30
  • 3
    @ConorMancone That is possible and an answer already exists for such a possibility. My answer deals with an another possible scenario that the password is encrypted. It is a possible scenario. No one can tell for 100% percent that the password is in plain text. What is wrong about writing answers for an another possible scenario? The typo does not indicate anything. He misspelled a single letter!!!
    – Kolappan N
    Commented Mar 27, 2019 at 12:40
  • 3
    @ConorMancone The OP said that he received the password in email when he did not ask for any. He could have abandoned his email. I consider transmission to be biggest issue. I agree with the fact that encrypting passwords is insecure too. No disagreements there.
    – Kolappan N
    Commented Mar 27, 2019 at 13:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .