Is it a bad idea for an information holder to e-mail a user their password?

Question

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my password.

Is this a bad idea?

My thoughts are that, yes, it is, on the grounds that:

1. If they are able to send me my password, does that imply that they're storing it unencrypted?
2. Given that e-mails like these were sent specifically due to my inactivity, it's possible that I no longer use that e-mail account, which means that it could have been compromised since I last used it.
3. Users frequently use the same passwords across multiple site. If e-mail is inherently insecure, revealing a password from one site in this way potentially compromises the user's accounts on other sites.

Answer 1

1. They are either storing it in plain text (likely) or they are using a reversible encryption. So in case of a compromise the password is at risk.

2. Yes, and it is even worse: Some email providers such as Hotmail delete inactive email accounts and allow other people to register it. The upper management of Twitter was successfully attacked by re-registering an old Hotmail account.

3. Yes, correct. A reused password, that was revealed in one of those mails, played an important role in the mentioned twitter attack.

Answer 2

Hendrik has provided a great set of problems. In addition, even if the service operators use SMTP with TLS to submit the mail from their reminder-bot's MUA to their local MTA, they then have no guarantee and no way of knowing whether the content remains encrypted all the way to your MDA and MUA. In other words: they could be showing anyone your password, even if you receive the mail correctly.

[As an aside, mailman is a high-profile mailing list manager that still follows this dangerous process. And guess what mailing list manager is used on the OWASP mailing lists? :-(]

Answer 3

In the abstract, of course it's a bad idea, for all the other valid reasons (e.g. "storing it in plaintext", "interception", "account hijacking and replay", etc.) that other respondents have stated.

The issue that I'd like to raise, however -- as is nearly always the case with IT security-related questions like this -- is, "compared to 'what'?" If an alternate method, less vulnerable to interception (preferably, out-of-band, e.g. ".zip your password into an encrypted archive, send it to you via e-mail and then call you by voice and dictate the password to you") method is available, then obviously that should be used.

But what if no such alternate channel is available, or is practical?

I can make a case that if the password that an end-user is likely to pick is "password" or "123456", that is inherently far more vulnerable than having a complex password e-mailed to that user, with instructions to use it only for a limited time and then change it to something equally complex (or to store it in a password manager like KeePass, LastPass or Password Safe, and then delete the plaintext version)?

Unless your name is "Snowden" or "Assange", the relative chance that all your communications will be constantly monitored -- and therefore you are at risk of having the TCP/IP data-stream intercepted and thereby having your password intercepted -- is actually very low. Whereas, the risk that a weak password will eventually be hacked, is quite high.

So it all comes down to a situation of risk analysis. If you are in a high-threat environment (for example you are a bank, and you need to communicate account credentials to high-income customers), then, yes, ANY form of password communications that can be intercepted, is likely not appropriate. If, on the other hand, you are running the Peoria, Ohio, Ladies' Auxilliary Floral Arrangement Society on-line discussion forum, and you need to give members password-protected access to the "Post Your Latest Flower Power Combinations" forum, then the consequences of a successful password interception and subsequent on-line attack, are likely to be much less, and perhaps a greater level of risk in communicating the credentials, can be accepted.

Answer 4

Yes, Mailing the passwords can make it liable for a steal. But on the other hand, It can also be helpful to the account owners in case they have forgotten about that site, provided the communication occurs using proper encryption.