Linked Questions

62 votes
3 answers

Website returning plaintext password [duplicate]

I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc. There is ...
stzvggmd's user avatar
  • 622
5 votes
3 answers

Forgot Password? - sends email with plaintext password [duplicate]

A "reputable" education company that my university utilizes for it's Physics course online materials sent my plaintext password in an email after using the Forgot Password? tool. I know that this is ...
Brandon Kreisel's user avatar
0 votes
1 answer

Company sent me a registration email with a clear text password [duplicate]

I recently signed up for a company's product, and promptly received an email confirming my registration, showing both my email address and my password. I'm not a security expert, but that was a huge ...
Jesse A's user avatar
4 votes
0 answers

Dealing with systems that store/send passwords in plain-text [duplicate]

Possible Duplicate: What to do about websites that store plain text passwords When using a system as it was designed to be used, and the system provides proof that it is storing and/or ...
blunders's user avatar
  • 5,062
0 votes
0 answers

Phone company keeping password in clear text [duplicate]

I recently found out that the Phone company where I have my contract is storing passwords on their server in clear text and employees can access it given the name or contract number of a person. ...
Eumel's user avatar
  • 101
0 votes
0 answers

How to approach a site that doesn't manage passwords correctly? [duplicate]

I am registered to a site which doesn't manage password correctly. It is a user area for a company that provides services of some sort and which uses the area to show details of the contracts and for ...
bracco23's user avatar
  • 123
0 votes
0 answers

Found out that a paid VPN service emails plaintext passwords [duplicate]

I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this. Here's how I found out: Bought a subscription on the wrong ...
MattIz's user avatar
  • 1
25 votes
7 answers

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
user avatar
22 votes
4 answers

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
Steve Melnikoff's user avatar
8 votes
3 answers

Is it ok for software to store passwords locally in plain-text?

There are already plenty of questions about what to do when websites store plain-text passwords. But this one is a little different. I use a piece of open-source (see below) software for playing ...
Selali Adobor's user avatar
5 votes
8 answers

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
Šime Vidas's user avatar
6 votes
1 answer

Who in UK I can report to if I know company is storing my password in plain text?

I live in UK, some time ago I wanted to login to my electric company account to check the bill and such, and I had forgotten my password - long story short I got my account locked and had to call them....
Matas Vaitkevicius's user avatar
3 votes
1 answer

Is it okay for websites to send passwords as plain text if they hash them when they are stored? [duplicate]

I was logging into a website and checking out the network requests, and in the network tab I saw the following: method: "Login" params: {username: "username", password: "password1234"} With my ...
DjangoBlockchain's user avatar
1 vote
2 answers

Is there a secure way that a website can retrieve and send your "forgotten" password in plain text [duplicate]

My question is related to What to do about websites that store plain text passwords. There are a few websites that I use that when I click "forgot password" my password is sent in plain text to the ...
StrongBad's user avatar
  • 251