2

I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.

marked as duplicate by schroeder, Xander, TildalWave, Rory Alsop Apr 19 '15 at 8:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    During the typical initial registration process, you've supplied them your password in plaintext. Until the full process completes (including emails), the process still has it in plaintext form (even after salting/hashing a copy of the password for placement in a user account database). If you do an online password recovery process later on, and they email you your plaintext password, then indeed you know they have stored your password in plaintext somewhere. – cybermike Apr 18 '15 at 7:25
  • So basically it is a normal procedure receiving plain text password during registration? – Michal Koczwara Apr 18 '15 at 7:29
  • 2
    @M.K No, it's not normal, and it's a sign of bad security policies. It just doesn't necessarily mean that they store your password in plaintext (but now at least your mail server does). – tim Apr 18 '15 at 7:32
  • 1
    I suspect they are issuing you a temporary password that once you log in with it, the system will ask you to enter a new password of your choosing. Then it will email that new password to you in the clear again :) However, some really old password recoveries are badly designed, they could just make that random numbers/letters your password, and you would likely have to change the password in a profile settings somewhere. – cybermike Apr 18 '15 at 7:56
  • 2
    Jeeze this is a poorly implemented site. So if this site has important information about you or is in some way valuable to you, then you do have some cause to wonder just how well this site understands modern security necessities. If this is just some random site you don't really care about and has no significant information about you, then perhaps just ignore its flaws. – cybermike Apr 18 '15 at 8:05
3

You don't know.

You technically don't even know whether the password is stored at all, let alone whether it's stored hashed. Them being able to email you the password immediately after you tell it to them says nothing of storage.

Not the answer you're looking for? Browse other questions tagged or ask your own question.