After I completed Account Setup Assistant process for a new SiteGround hosting service, I got this confirmation screen on the website:
... just log in to your Wordpress control panel with the details below: Admin URL: XXX Username: XXX Password: XXX
In place of
XXX, there were actually my username and password in plain text.
This was delivered in a new page over HTTPS; the HTML of the page contained:
<p><span class="bold">Username:</span> XXX</p> <p><span class="bold">Password:</span> XXX</p>
From that I conclude that they don't use client-side password hashing. I was surprised; I thought it was normal industry practice for sensitive services. Is it not the case?
Apart from the above, is there any security issue with displaying password back to me in plain text? (I assume they don't actually save it in plain text in a database - that would be atrocious; presumably, it only stays in memory of their web server, while it's preparing the response to my POST request; I hope it is hashed/salted before being saved in any persistent storage).
Note: they did NOT include plain text password in the email confirmation; only on a single web page that is only available right after I signed up.