156
OP finds vulnerability where a forum sends you your password in plaintext over email and everyone misses the forest for the trees (lemmy.world)
submitted 3 years ago by to c/programming@programming.dev
85 comments fedilink hide all child comments
 

This thread is frustrating. Everyone seems more interested in nitpicking the specifics of what OP is saying and are ignoring that a forum sends you your password (not an automatically generated one) in an email on registration.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 3 years ago* (2 children)

It's storing it in plain text in at least one third party's database. Indeed, it's not stored in plain text locally, it's doing something much worse

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 3 years ago (1 child)

    But you are supposed to change that generated password as soon as you use it to login. Now I have no idea about these forums, but you'd expect the software to enforce that need to change

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 years ago

    It's still stupid because people reuse password. They shouldn't, but they do. If it's one time login, make it a token. There's zero reason to ever email a password, period

  • permalink
  • fedilink
  • source
  • parent