What's wrong with generating a password for you without storing it?
Like why is MasterCard on the plain text offenders list?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
There might be 50 shades of gray area regarding how bad the violation is. Here's a suggested order beginning with the worst offense:
Final Note: if an attacker has open ended access to your email account, you might argue that even #6 doesn't protect you, since the attacker could go reset your password on a banking site, receive the reset link and change your password, then login to the site. This is absolutely true. However, the next time you try to login to the site you will be unable to, and hopefully you will come to the conclusion that something isn't right, which will lead to another password change and possibly a password change on your email account too. Some sites will even tell you the last time you changed your password to help you come to that conclusion on your own.
Because most users do not change their password after such a reset and mindlessly instruct their browser to save the new password and/or the site does not force users to change it after their first login.
Thus they effectivly send the new password in plain text, thus they are offenders.
A better way may be a One-Time-Token for a password reset, preferably sent via snail mail or SMS.
The description in the About section of their page gives me the impression that the definition of Plain Text Offender depends solely on the storing of data:
A website storing a password in plain text means that your password is there, waiting for someone to come and take it. It doesn’t even matter if you’ve created the strongest possible password. It’s just there.
Whether it’s someone hacking into their servers, using a simple flaw in their site or even stealing their backups, over 30% of sites store plain text passwords.
We’re tired of websites abusing our trust and storing our passwords in plain text, exposing us to danger. Here we put websites we believe to be practicing this to shame.
Reading this, it does sound like having a newly generated password emailed to you would not necessarily make the company a Plain Text Offender according to their definition. That is assuming they still STORE the password hashed (and hopefully salted).
I would however say that emailing a user their password is not ideal regardless, for reasons stated by SmokeDispenser and wireghoul.