Recently a utility provider has started to attach a zip file including my bill inside, however, they have secured the zip file using my online web account password.
I am not too concerned about somebody getting my bill, however, it concerns me in two other ways...
First, would this now allow for easier dictionary attacks? If a malicious actor where to get a hold of the zip file, they could run a dictionary attack against it with no real knowledge right? Online they would be able to try and prevent this however when this media is downloaded there is no way to put in any preventatives.
Second, are they storing my password in plaintext (or another recoverable format)? It seems unlikely they would be able to use the same hash across both the site and the zip file they are sending out, right?
I use a unique long/secure password for this account, as well as a unique email, so I am not too worried about the issue affecting me personally.