Please store our passwords more securely!

[Zenkai]

When I signed up for this website, I was emailed an activation link. That email also contained my username and password in cleartext. 

You should not be able to send me my password in cleartext if you were securely storing my password (i.e. hashed and salted). This means you are storing our passwords in cleartext and we are just waiting for a disaster to happen.

Can you please improve your password security?

 

[dpfks]

Passwords are hashed and salted in database.

Just because passwords are emailed in plain text for you to use, does not mean they're stored in plain text. You can manually change your email to skip the emailing of password part (again passwords are hashed in database). Regardless, extra security will be added once the new site is released for those who are paranoid.

 

[[deleted]]

When I signed up for this website, I was emailed an activation link. That email also contained my username and password in cleartext. 

You should not be able to send me my password in cleartext if you were securely storing my password (i.e. hashed and salted). This means you are storing our passwords in cleartext and we are just waiting for a disaster to happen.

Can you please improve your password security?

dude its a porn tube site. You don't even NEED to register.

 

[Zenkai]

Can we please assume good intentions? I'm not here to shit on your parade, I'm trying to bring a security issue to your attention. 

Just because passwords are emailed in plain text for you to use, does not mean they're stored in plain text.

It means you are either storing them in plain text or using reversible encryption. Both are Bad Ideas (tm)

for those who are paranoid.

Look, this isn't 1997 anymore. I'm not paranoid. You're naive.

dude its a porn tube site. You don't even NEED to register.

You don't know what I'm here for. I'm not sure what you're contributing to this conversation.

 

[dpfks]

Can we please assume good intentions? I'm not here to shit on your parade, I'm trying to bring a security issue to your attention. 

Just because passwords are emailed in plain text for you to use, does not mean they're stored in plain text.

It means you are either storing them in plain text or using reversible encryption. Both are Bad Ideas (tm)

for those who are paranoid.

Look, this isn't 1997 anymore. I'm not paranoid. You're naive.

dude its a porn tube site. You don't even NEED to register.

You don't know what I'm here for. I'm not sure what you're contributing to this conversation.

I agree the emailing the password initially is bad practice. This is a poor design by the script we're using. Also all front-end registrations are inputted as clear text initially.

Again, we are heavily revamping the site in the upcoming weeks. This issue will be resolved.

To emphasize, passwords are NOT stored in clear text. If you lose your password we cannot recover it, that is why people need to use the reset feature to obtain a new one.

 

[Zenkai]

Ok, thanks for the quick response.