Comment on Larion Studios forum stores your passwords in unhashed plaintext.
nickwitha_k@lemmy.sdf.org 1 year ago
That’s very unlikely. It’s running UBB Threads, which, from what I can tell, has an auth subsystem, which au minimum would do hashing. If it’s providing you with a default at sign-up, that’s different and is what appears to be a configurable setting.
If it is completely generated for you, here’s what probably happening:
- User creation module runs a password generator and stores this and the username in memory as string variables.
- User creation module calls back to storage module to store new user data in db, including the value of the generated password var.
- Either the storage module or another middleware module hashes the password while preparing to store.
- Storage module reports success to user creation.
- User creation module prints the vars to the welcome template and unloads them from memory.
TL;DR as this is running on a long-established commercial php forum package, with DB storage, it is incredibly unlikely that the password is stored in the DB as plaintext. At most it is likely stored in memory during creation. I cannot confirm, however, as it is not FOSS.
Cabrio@lemmy.world 1 year ago
It sends the user generated password, not an auto generated one.
hex@programming.dev 1 year ago
Yeah if they send the password in an email in plain text that’s not storing it. You can send the email before you store the password while it’s still in memory and then hash it and store it.
Cabrio@lemmy.world 1 year ago
Still bad practice and a security vulnerability at best. Email isn’t E2E encrypted.
beefcat@lemmy.world 1 year ago
there is no possible way to handle sensitive data without storing it in memory at some point
it’s where you do all the salting, hashing, and encrypting
oneiros@lemmy.blahaj.zone 1 year ago
Given what I know about how computers accept user input, I am fascinated to hear what the alternative is.