1

I used to login into a certain website a couple of years ago. Recently I've got an email suggesting that I should renew my membership, and that email included my old password. That's right, my old password was emailed to be verbatim over SMTP.

That implied two things:

  1. They store passwords as unencrypted text rather than one-way hashes, which makes all current and former members' information very vulnerable.

  2. They send around those passwords in unencrypted emails, which makes their members' information extremely vulnerable.

So I went on your website to see whom to contact regarding fixing these security bugs, and, to my surprise, found these gaping security holes were there by design! Specifically, I clicked the button to remind me my password and got this email:


You, or someone posing as you, has requested a password reminder for your membership on the mailing list "the website".

....

You are subscribed with the address: "my email, unencrypted"

Your "the website" password is: "my old password, unencrypted"


So sent an email to the webmaster listed on the site; unfortunately the email bounced back as undeliverable. I am not employed at that site, but I find is difficult to ignore the issue because that would be leaving thousands current and former users very vulnerable. The website is not a local general store, it belongs to a well-known (among software engineers) lab at a major university and may have thousands of user accounts.

Thus the question: what further steps can/should I take to improve IT security there?

migrated from serverfault.com Feb 17 '17 at 17:33

This question came from our site for system and network administrators.

  • 6
    Since you are not employed there you can probably only do public vendor shaming and hope that it gets better. But I propose to close this question because it is primarily opinion-based. – Steffen Ullrich Feb 17 '17 at 17:39
  • Was your old password auto generated or one that you created? – TTT Feb 17 '17 at 17:48
  • 1
    Closely related: Reference for Insecure password by email – Gilles Feb 17 '17 at 18:00
  • 1
    Don't use it anymore? – oɔɯǝɹ Feb 17 '17 at 18:17
  • 1
    You can find a technical contact email on the whois register. You could try them if the webmaster contact is bouncing – iainpb Feb 17 '17 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.