1

I am living in a student housing in UK.

Today, I was suddenly asked to put in my log in credentials for the internet service and because I forgot the credentials, I went to find my password section.

Guess what... an ISP... storing password as

PLAINTEXT!

enter image description here

The blacked out section after

"You password is:"

is not a temporary password... it actually is the full, existing password that I entered at sign up..

Is there any way to report this and force them to encrypt their passwords?

  • 1
    The process is basically publicly shaming the ISP until they either go out of business or start hashing (it's not the same as encrypting, by the way) their passwords. Let them know that you intend to publicly shame them before you actually do. – KnightOfNi Aug 9 '14 at 4:06
  • 2
    Report them to plaintextoffenders.com – Lucas Kauffman Aug 9 '14 at 5:15
  • PlaintextOffenders time ! Unfortunately there are no laws against plaintext passwords so you can't force them if they don't mind the shame (which won't do the much damage because most of the users don't even know what password hashing is), so the only real solution is to change ISPs. – user42178 Aug 14 '14 at 11:16
1

Definitely make sure you are using different unique and complex password for each site - especially something like your ISP.

And of course http://plaintextoffenders.com/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.