Comment on Larion Studios forum stores your passwords in unhashed plaintext.

• hex@programming.dev ⁨1⁩ ⁨year⁩ ago

  Yeah if they send the password in an email in plain text that’s not storing it. You can send the email before you store the password while it’s still in memory and then hash it and store it.

  source

  • Cabrio@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Still bad practice and a security vulnerability at best. Email isn’t E2E encrypted.

    source

    • beefcat@lemmy.world ⁨1⁩ ⁨year⁩ ago

      there is no possible way to handle sensitive data without storing it in memory at some point

      it’s where you do all the salting, hashing, and encrypting

      source

      • JackbyDev@programming.dev ⁨1⁩ ⁨year⁩ ago

        emailing out credentials like this after sign up is certainly not best practice,

        Understatement of the year right here. Everyone in this thread is more interested in dunking on OP for the few wrong statements they make rather than focusing on the fact that a service is emailing their users their password (not an autogenerated “first time” one) in plaintext in an email.

        source
      • RonSijm@programming.dev ⁨1⁩ ⁨year⁩ ago

        there is no possible way to handle sensitive data without storing it in memory at some point

        Since we’re nitpicking here - technically you can. They could run hashing client side first, and instead of sending the password in plain-text, you’d send a hashed version

        source

        • -> View More Comments
    • oneiros@lemmy.blahaj.zone ⁨1⁩ ⁨year⁩ ago

      Stored in memory is still stored.

      Given what I know about how computers accept user input, I am fascinated to hear what the alternative is.

      source

      • Cabrio@lemmy.world ⁨1⁩ ⁨year⁩ ago

        You have the text input feed directly into the encryption layer without an intermediary variable.

        source

        • -> View More Comments