So, a site that I was using to sign up for an academic conference transmits information unencrypted (HTTP), including passwords. Then I see, using the 'forgot password' function gets me an email with my password in plaintext. I understand the security implications of this - this is horrible.

My questions is, what should I do? Should I send them an email, and if so, how should I convey this information? Should I tell/warn colleagues about this?

  • 1
    this is yet another reason why you should use a password manager. – dandavis Nov 8 at 20:47
  • In addition to starting to use a password manager from now on... if you have used that password anywhere else, assume that it is breached, and change it on all relevant sites. – Ghedipunk Nov 8 at 21:12
  • Oh yes, definitely. While I don't use a password manager for other reasons, and I've adopted password-variations technique like some others have. I'm definitely not using this variations built on this one any more! – tpepin96 Nov 8 at 21:14
  • 1
    by variation do you mean some sort of password algorithm? If I could see 3 of your passwords for different sites could I guess your password for a 4th site if you gave me 10 guesses? – DarkMatter Nov 8 at 22:24
up vote 2 down vote accepted
  1. Make sure they aren't part of the network of predatory publishers (such as W.A.S.E.T or O.M.I.C.S).
  2. You should email the conference organizer to alert them to these issues. If there is a national organization behind it consider checking to see if the issue is endemic and if so alert the national governing body of that organization as well.

Note* be prepared for them to not be thankful for your help.

  • Thank you for this response. The conference is a meeting of one society of dozens under a large engineering professional association. And I'm not sure how I could check if this is endemic to the organization. (I could not find any complaints on the internet about this specific society's site, let alone the association itself.) – tpepin96 Nov 8 at 21:01
  • Maybe a stupid question, but what's the reasoning behind your point #1? – user8675309 Nov 8 at 22:17
  • @user8675309 Just had a hunch... ever since I watched youtube.com/watch?v=ras_VYgA77Q I'm paranoid about sketchy conferences. – DarkMatter Nov 8 at 22:20
  • @tpepin96 usually these things have multiple domains reserved for various different conferences that all are under the same org. If the issue was present with each of these sites (and not just yours) you should probably escalate the issue. – DarkMatter Nov 8 at 22:22

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.