20

Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received the password in my e-mail in plain text.

I would imagine that to make this possible, the password would have to be stored in plain text somewhere in the database. Is this necessarily true?

Improve this question
5
  • 20
    Yes! Yes! Yeeeeeeeeeeeeesssssssssssssssss!
    – ewanm89
    Oct 29, 2012 at 22:27
  • 4
    They could encrypt (probably aren't though) it in the database, but a decryption key is going to be available to that server. Finally, an email on the wire is not secure.
    – ewanm89
    Oct 29, 2012 at 22:28
  • 10
    plaintextoffenders.com
    – Mormegil
    Oct 29, 2012 at 22:37
  • I applied to become a graduate InfoSec consultant and this happened to me! I quickly revoked my application!
    – LukeJenx
    Oct 30, 2012 at 11:47
  • Out of curiosity, are you getting your password back in plaintext? Or is it a new password?
    – Randy E
    Nov 1, 2012 at 22:22

4 Answers 4

Reset to default
28

Yes you should be concerned if you use the password on other websites or have personal data stored on it. This is one of the reasons you have to have different passwords for every website. They are storing your password plain text. I'd stay away from with personal data. It's one of those basic security principles they violated, chances are that there will be more.

Improve this answer
12

You should be concerned only if you care about other people accessing your account on that site. Not only because they're storing your password in plaintext in their database, and not only because they've sent your password in the clear via email, but also because they obviously don't care enough about securing your account to make even a minimal effort.

What you should do in such a case is report them to http://plaintextoffenders.com/. This is a Tumblr site which collects evidence that various sites store passwords in the clear. The goal of this site isn't just the LULZ, but also to warn users of this issue and to shame the sites into mending their ways.

Improve this answer
1
  • 1
    Some of those aren't necessarily storing passwords in plain text. Just because you e-mail the password upon registration (which I'm not claiming is a good idea) doesn't mean you're storing the plain text password in the database.
    – Snuffleupagus
    Oct 30, 2012 at 14:04
6

Yes, you have to. If a tool can send your password, it means that your password is stored somewhere in a format, which is finally human-readable. Don't trust in that application or system.

Improve this answer
1

Well for having the password stored in plaintext in their database: If they email you a new password instead of your old one, then maybe they just generated a random password, salted, hashed and stored it but if they email you your own password then yes definitely stored as plaintext!

Improve this answer
2
  • In either case the password is being transmitted in plaintext which is the core of esqew's question.
    – Scott Pack
    Nov 1, 2012 at 20:53
  • @ScottPack yes, that is right, but my answer was intended for the 2nd part: "I would imagine that to make this possible, the password would have to be stored in plain text somewhere in the database. Is this necessarily true?"
    – Afaan Bilal
    Mar 7, 2013 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.