156
OP finds vulnerability where a forum sends you your password in plaintext over email and everyone misses the forest for the trees (lemmy.world)
submitted 3 years ago by to c/programming@programming.dev
85 comments fedilink hide all child comments
 

This thread is frustrating. Everyone seems more interested in nitpicking the specifics of what OP is saying and are ignoring that a forum sends you your password (not an automatically generated one) in an email on registration.

you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 3 years ago* (last edited 3 years ago)

An issue if you’re reusing passwords. If not, every forgot my password email is also vulnerable.

A combination of bad practices could be… bad.

Edit: apparently around the same time, their forum was also lacking https. This would be an even easier vector.

  • permalink
  • fedilink
  • source
  • parent