23

I forgot the password to a webmail account and they didn't have an automated password recovery process. So I had to chat with their support and they asked a few verification questions then proceeded to tell me my password.

If they know my password doesn't this mean one of two things?

The passwords are stored in clear text and they can just look them up or they have some kind of two-way hash and can decrypt the password. How else could they have known what my password was?

This is a large national ISP and it makes me very uncomfortable knowing they can look up my password whenever they want. Can someone confirm that this is a big security issue and they should not be doing this.

Thanks

Improve this question
6
  • 6
    Sure they didn't reset the password on your behalf after confirming your identification? Anyway, after getting the password from them, you can login and change it to any other password, so that only you will now know your password. – Senthil Kumar Nov 15 '12 at 9:36
  • 8
    As it was noted in an answer below, please submit this site to plaintextoffenders.com. Everyone needs to know about this. – Omer van Kloeten Nov 15 '12 at 9:45
  • 2
    Having gone through something similar during an Intranet Site rollout, being able to recover the password doesn't mean its stored plain-text. It DOES mean that in the best case scenario, it's Encrypted/Decrypted and not one-way-hashed. stackoverflow.com/a/4948393/409025 . Still not a good thing that Joe Blow can read you back your password. – WernerCD Nov 15 '12 at 12:23
  • 4
    Are you sure that they told you what your password originally was, rather than changing it? – Megan Walker Nov 15 '12 at 13:28
  • 1
    Report them to plaintextoffenders.com – Phil Nov 15 '12 at 14:50
41

CHANGE YOUR PASSWORD it has been compromised.

Politely inform this service provider that this is a very serious vulnerability. Passwords must be reset, and must never be stored in a recoverable format. Further more this is the type of vulnerability is inexcusable, use another service ASAP. Tell them that you are no longer using their service out of very serious security concerns. If they made this mistake, just think of the other festering security problems.

Improve this answer
3
  • 14
    And, in the meantime, change the password to something completely distinct from any of your existing passwords (this is a good practice regardless). – Stephen Touset Nov 15 '12 at 4:14
  • @Stephen Touset totally agree. – rook Nov 15 '12 at 4:20
  • And while at it do use a password manager like KeePass. Highly recommended when you have a lot of passwords as you'll be able to store distinct and decent passwords in it. Just make sure you don't forget the master KeePass password or loose the key files (recommended to have both set of course). Cheers. – Mario Awad Nov 19 '12 at 20:50
18

Definitely not good. In addition to damage limitation (changing your passwords if you use the same password in other places, which we all know is a bad idea but still happens too often), and looking at alternative providers, I suggest you name and shame them, here and on Plain Text Offenders. Actually, the fact that a human could look this up is in many ways even worse than the all-too-common "the server could look it up and email me".

Improve this answer
6
  • 7
    I'm the co-founder of plaintextoffenders.com and I approve of this post :) – Omer van Kloeten Nov 15 '12 at 9:42
  • +1, otherwise they will never have a business justification to change their policies. – Sedat Kapanoglu Nov 15 '12 at 9:46
  • 3
    +1 for «the fact that a human could look this up is in many ways even worse» – ZJR Nov 16 '12 at 2:15
  • 1
    @Rook yes, much better to pretend that the problem doesn't exist, so that nobody ever fixes it, and nobody knows which sites to avoid. – Marc Gravell♦ Nov 16 '12 at 21:31
  • 1
    As mentioned in the comments at the top of the page; this doesn't necessarily mean that the password is stored in plain text, or does plaintextoffenders.com deal with more than just "plain text" offenders? – MrWhite Nov 20 '12 at 11:21
7

This is not good practice but is unfortunately common with many large providers. You should question their security practices and procedures. If they do not provide you with a sufficient amount of information or are not willing to satisfy your security needs then you should change providers.

A few questions you could ask:

  • How do you secure personal and confidential information? ie. passwords
  • How was a staff member able to view my password in plaintext?
  • Why is there no password reset feature for email accounts?
Improve this answer
2
  • 3
    No I'm sorry but there is no excuse for this. – rook Nov 15 '12 at 4:21
  • 5
    I know that. I am simply stating that he should try and reason with his provider first and if they are not willing to change their security measures then he can switch providers. If nobody challenges them for their security flaws then they are not going to fix them. – Hammo Nov 15 '12 at 5:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.