I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext.
Last week I installed a VPN add-on for Firefox then created an account and changed the default password before using it. It is good and also fast, but a few days later, when I checked my spam, I saw that the VPN provider sent me an email dated on the day I changed the password, with my password in plaintext. I thought it could be just a bug on their side.
So what I did next was to try to forgot my password, to see if they would send me my actual password or a reset link. But unfortunately they sent my password back in plaintext.
I sent them an email to their support but I didn't get a reply. After a few days of silence, I wrote a review on their Firefox page and sent a report abuse. After an hour they emailed me saying that:
they need to be stored plain because of vpn authentication. you send them there plain. Otherwise they cannot work
My question is, is it true that they need to store the password in plaintext to make the VPN works? Or it is just beyond there capabilities to safely store user credentials?
Just think about the users that use the same password on their other accounts. That could be the case for most of us.