0

I registered to a www-site. After that I got a mail where was given info like thanks for registering to our site. Your password is and password in plain text. Does it mean that the site does hold my password in plain text and there is a security hole?

1
  • 1
    Did you supply the password or was it created by the site?
    – zaph
    Sep 30, 2018 at 13:41

3 Answers 3

6

Since you've just registered at the site it might be that the password you've just entered was included in the mail without storing it in plain in the database. So while it might be that the site stores the password in plain one cannot conclude this just from this mail.

Even if the password is not stored as plain at the server it is still insecure to include the plain password in a mail which is not end-to-end encrypted (i.e. using PGP or S/MIME). Usually mails are not end-to-end encrypted but at most encrypted for the transport between mail servers and to the mail client, but they are accessible in plain at each mail server involved in transport or storage of the mail. This also means that your password is accessible at these servers.

1

i assume the password was given by you on the site and it was not auto generated. if it was auto-generated, the first time you use the pass, the site should ask you to change the password.This scenario should be okay.

But if pwd was supplied by you during the reg then getting that back by email has several security issues. Like getting sniffed from the registering website network or from your network. Also, now you have your pwd in your mail which can be gained to anyone who has your auth/unauth email acess.

There is no way to tell whether pwd is really being stored as a plain text in their DB.

0

Is there a forgot password feature? Try going through that, if they are storing it in plain-text they might send you your password but no guarantee.

You can't be sure, but how long does the login request take to respond? I.e. is it instant or does it take a second/a little longer than other page loading times?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .