Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Unencrypted passwords at "secure" sites

linear a (584575) writes | more than 6 years ago

Privacy 1

linear a (584575) writes "I've noticed that quite a few web sites do *not* encrypt user passwords. I've gotten into the habit of hitting the "email me my password" from them to see what happens. So far I've found maybe 6 that must store passwords in clear since they were able to return the original password back to me. Clearly this is Bad Security Practice. Also, I've had notably bad progress when I ask them to fix this practice. Some of these are sites one would clearly expect to have better security (e.g., a software vendor and an online bank). Do you have thoughts on how to better encourage better password practice at these places? Also, is this is really as common as it seems to be for me?"

cancel ×

1 comment

That's not proof of plaintext storage (1)

artifex2004 (766107) | more than 6 years ago | (#20092171)

You're assuming that everyone either stores plaintext or stores in a password file, using hash to compare logins to the encrypted password. But you can encrypt the passwords and store them with a key that only a system process has access to, to decrypt and send them back.
Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...