My city has online billing for utilities. When you set up an account they email your user name and password to you. You can't change your password without them emailing it to you again. Isn't this insecure? Doesn't that mean my user name and password is being sent in the clear and someone can log on to my account?
Yes this is correct. Security principles dictate that you should be able to set your own password.
Its definitely a bad practice. This means that there are no password hashing mechanisms in place and the application knows the passwords used by its users.
I would recommend not using the same password for your other online activities.
I will echo that this is very poor practice, but depending on your situation, it may simply be "poor" instead of "disastrous".
For example, if the billing information that you access with those credentials only shows power consumption for user number 3187987 for the current month (where that number is unique and unrelated to a person or address) then a breach doesn't reveal much sensitive information.
Some systems are deliberately designed with this in mind; we don't know if this applies to your situation.
I would encourage you to email your council and explain why you are concerned about the current situation (do let us know what they say).
An alternate solution, just to moderate all of this crying foul: the passwords are hashed and stored as being associated to usernames in the sever, and the answer to a "Security Question" (which we must assume exists) is used to hash the password. This is the solution to the main problem: passwords are hashed so that the server, which we must assume does not store the answers but simply sends the plaintext of the decryped password regardless of its correctness. Now, the hash wouldn't be very strong, but this would work. As to sending it via plaintext, there are a huge variety of things that someone could do to you if they read your e-mails, including, for instance, resetting your Paypal password (by using the password reset link themselves). Why on earth would they bother with reading your bills?
It is my understanding that, unless they are doing something to securely deliver the email to you, that they are effectively writing your password on a postcard and sending it out for any sniffers to see. Combined with the system having your PII (name, phone, address, ect.) and financial information, I would be concerned. And while it is an assumption, I would guess that other areas of security within this application will not be much better.
If you contact the general email asking for tech support help, you may be able to get to a person who will be able to contact the developer, who can then talk to.
Not being able to set your own password nowadays feels kinda weird. Is it because they don't trust users to use strong passwords, or is it because it's easier for them to generate it automatically? (I would think the latter)
As for sending the username and password by email, it's not the only website that does that just after registration. If later on you request your password and they send it to you again, it means they stored it in clear text. If on the other hand they generate a new password, it hopefully means they're not storing it in clear text.
If they are using HTTPS to send the email, and you're using HTTPS to read it, it should be safe right? (as long as of course they're not storing the passwords in clear text, and even better they're adding a unique salt to each account)