2

Yesterday I registered on a site that looked good and secure enough, or at least it was.

The problems are:

  • When filling registration from, the password was 8 characters max!!
  • After completing, I received a register confirmation email, with my complete information, including my password!

Now, I've unlinked that site from my email, but I'm wondering:

  • What danger can come from this?
  • Can this affect my email in anyway?
  • If my email is linked to social websites, will that be dangerous?

or that's just acceptable and legitimate?

Improve this question
3
  • Biggest issue is that password is now floating around in various places - your email, their DB (probably), and maybe elsewhere. Anywhere else you've used the same password, change it.
    – SomeoneSomewhereSupportsMonica
    Commented Sep 25, 2016 at 10:57
  • What's the point if they're saving it as a plain text? of course it's a unique password. I never use the same password twice.
    – Eibo
    Commented Sep 25, 2016 at 10:58
  • 1
    Then you've mitigated the largest risk: someone finding your password from this site and using it to log in elsewhere. The password is in your email, so anyone with access to your email can log into the account - but they could probably do that anyway.
    – SomeoneSomewhereSupportsMonica
    Commented Sep 25, 2016 at 11:03

2 Answers 2

Reset to default
4

If they have restricted the max password length to 8 characters, it demonstrates that they are not correctly or safely hashing it into their database. So all of the data you have entered can be considered compromised.

It would be helpful to share the site so that others can avoid it.

If you use that password for anything else, change it everywhere else straight away.

If the site in question has any information about you, I recommend changing that information straight away to something random.

Afterwards, write to them and ask for all of your information to be removed from their systems immediately. Explain to them politely why you are doing this.

  • What danger can come from this?

    All of the information you've entered must be considered compromised since they have clearly demonstrated a complete lack of understanding or care about the data.

  • Can this affect my email in anyway?

    As Mirko says, if you've used the same password then you need to change it immediately. Otherwise, the main "danger" is from spam from compromised customer databases.

  • If my email is linked to social websites, will that be dangerous?

    It isn't really dangerous but it may expose you to more spam. Spam can, of course, be dangerous in itself. You might also be exposed to cyber bullying or stalking depending on how vulnerable you might be to such things.

Improve this answer
1

I see many possible problems here:

if they send you the password in plaintext, there are 2 possibilities:

  • they save in the database the plaintext -> bad practice (if DB leaked the attacker has immediately your password)
  • they send it to you, hash it and save in the db -> not so good but it's ok

If the max size is 8 means that:

  • the password is more easy to guess -> choose wisely (use: special char)
  • if the DB is leaked, crack passwords requires little time

I think it cannot effect your mail, unless you have insert the same password!

Again, for the social website, in the worst case scenario if theirs DB is leaked (but the password is different) the attacker just knows your mail.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .