Comment on Larion Studios forum stores your passwords in unhashed plaintext.

vox@sopuli.xyz ⁨1⁩ ⁨year⁩ ago

• Mirodir@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago

  …and if they keep the emails they send out archived (which would be reasonable), they also have it stored in plaintext there.

  source

  • Thadrax@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Automatically generated emails usually don’t get saved.

    source

    • glitches_brew@lemmy.world ⁨1⁩ ⁨year⁩ ago

      As the designated email dev at my company I can confidently say this is not true.

      Not saying that this specific email is persisted, but almost all that I work with are. It’s a very common practice.

      source

      • Rambomst@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Yeah, we save most emails sent out at my work.

        source
      • tocopherol@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago

        I wonder how much this varies depending on the amount of data it would require to store the emails of a company. I know nothing about this subject, but does it occur where companies with very large email lists would forgo storing those types of emails to save data costs?

        source

        • -> View More Comments
• tb_@lemmy.world ⁨1⁩ ⁨year⁩ ago

  But that still means they had your plaintext password at some point.

  source

  • vox@sopuli.xyz ⁨1⁩ ⁨year⁩ ago

    hashing on client side is considered a bad idea and almost never done.

    source

    • sleepy555@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Really everytime you log in too.

      source
    • wim@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

      It’s not a bad idea and it is often done, just not in a browser/webapp context.

      source

      • hotdoge42@feddit.de ⁨1⁩ ⁨year⁩ ago

        Can you give an example where this is done?

        source

        • -> View More Comments
  • Kilamaos@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Of course. You receive the password in plain on account creation, do the process you need, and then store it hashed.

    That’s fine and normal

    source

    • kadu@lemmy.world ⁨1⁩ ⁨year⁩ ago

      [deleted]

      source

      • Vegasimov@reddthat.com ⁨1⁩ ⁨year⁩ ago

        When you create an account you type your password in. This gets sent to the server, and then it is hashed and stored

        So there is a period of time where they have your unhashed password

        This is true of every website you have ever made a password on

        source

        • -> View More Comments
  • Hexarei@programming.dev ⁨1⁩ ⁨year⁩ ago

    Um. Yeah, because you provided it to them. They have to have it in plain text in order to hash it.

    source
• dangblingus@lemmy.world ⁨1⁩ ⁨year⁩ ago

  I’ve literally never had a service provider email me my own password ever. Maybe a OTP, but never my actual password. And especially not in plaintext.

  What would be the necessity behind emailing someone their own password? Doesn’t that defeat the purpose of having a password? Email isn’t secure.

  source

  • wim@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

    I find that very hard to believe. While it is less common nowadays, many, if not most, mailing list and forum software sent passwords in plaintext in emails.

    A lot of cottage industry web apps also did the same.

    source

    • EssentialCoffee@midwest.social ⁨1⁩ ⁨year⁩ ago

      They’re probably just young.

      source
  • benjacoblee@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Idk if I’m misremembering, but it’s my impression that they did this a lot in the 2000s, haha. I guess bad practices have a habit of sticking around

    source
  • EssentialCoffee@midwest.social ⁨1⁩ ⁨year⁩ ago

    I’ve had service providers physically mail my own password to me before. Just crazy.

    Always use unique passwords for every site.

    source
• TheEighthDoctor@lemmy.world ⁨1⁩ ⁨year⁩ ago

  So it’s in plaintext in their email system

  source

  • Thadrax@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Generated emails usually don’t get saved, as soon as it is delivered it will be gone.

    source
  • vox@sopuli.xyz ⁨1⁩ ⁨year⁩ ago

    these emails don’t usually get copied to local outbox folder (as any oher auto generated emails)

    source
• JackbyDev@programming.dev ⁨1⁩ ⁨year⁩ ago

  “Kinda a bad idea?” This is fucking insane.

  source

  • Umbraveil@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Is it though? While it certainly isn’t something I’d recommend, and I’ve encountered it before, if E2E encryption exists we cannot assume a data exposure had occurred.

    What they do on the backend has nothing to do with this notification system. Think of it as one of these credentialess authentication systems that send a ‘magic link’ to your inbox.

    source