156
OP finds vulnerability where a forum sends you your password in plaintext over email and everyone misses the forest for the trees (lemmy.world)
submitted 3 years ago by to c/programming@programming.dev
85 comments fedilink hide all child comments
 

This thread is frustrating. Everyone seems more interested in nitpicking the specifics of what OP is saying and are ignoring that a forum sends you your password (not an automatically generated one) in an email on registration.

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 3 years ago* (1 child)

The one they were sending at registration was prior to hashing. It would not be reversible afterwards.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 3 years ago*

    That's technically less terrible, then.

    Good for them. /s

    Edited to add the /s for clarity, because the NIST recommended remediation in 2023 for emailing a password is "burn everything down and pretend the organization never existed". /s

    Again, adding that /s since that's not actually what NIST says to do, and I am, at best, paraphrasing.

  • permalink
  • fedilink
  • source
  • parent