So, a site that I was using to sign up for an academic conference transmits information unencrypted (HTTP), including passwords. Then I see, using the 'forgot password' function gets me an email with my password in plaintext. I understand the security implications of this - this is horrible.

My questions is, what should I do? Should I send them an email, and if so, how should I convey this information? Should I tell/warn colleagues about this?

  • 1
    this is yet another reason why you should use a password manager.
    – dandavis
    Commented Nov 8, 2018 at 20:47
  • In addition to starting to use a password manager from now on... if you have used that password anywhere else, assume that it is breached, and change it on all relevant sites.
    – Ghedipunk
    Commented Nov 8, 2018 at 21:12
  • 1
    by variation do you mean some sort of password algorithm? If I could see 3 of your passwords for different sites could I guess your password for a 4th site if you gave me 10 guesses?
    – DarkMatter
    Commented Nov 8, 2018 at 22:24

1 Answer 1

  1. Make sure they aren't part of the network of predatory publishers (such as W.A.S.E.T or O.M.I.C.S).
  2. You should email the conference organizer to alert them to these issues. If there is a national organization behind it consider checking to see if the issue is endemic and if so alert the national governing body of that organization as well.

Note* be prepared for them to not be thankful for your help.

  • Thank you for this response. The conference is a meeting of one society of dozens under a large engineering professional association. And I'm not sure how I could check if this is endemic to the organization. (I could not find any complaints on the internet about this specific society's site, let alone the association itself.)
    – lynn
    Commented Nov 8, 2018 at 21:01
  • Maybe a stupid question, but what's the reasoning behind your point #1? Commented Nov 8, 2018 at 22:17
  • @user8675309 Just had a hunch... ever since I watched youtube.com/watch?v=ras_VYgA77Q I'm paranoid about sketchy conferences.
    – DarkMatter
    Commented Nov 8, 2018 at 22:20
  • @tpepin96 usually these things have multiple domains reserved for various different conferences that all are under the same org. If the issue was present with each of these sites (and not just yours) you should probably escalate the issue.
    – DarkMatter
    Commented Nov 8, 2018 at 22:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .