Comment

Comment on OP finds vulnerability where a forum sends you your password in plaintext over email and everyone misses the forest for the trees

abhibeckert@lemmy.world ⁨1⁩ ⁨year⁩ ago

Everyone seems more interested in nitpicking the specifics of what OP is saying

Yep. That’s how security works. You have to nitpick the specifics.

The hard reality is nobody has ever invented a perfectly secure authentication system that is easy to use (for example, allows easy recovery when people forget their password which for any large service will be tens of millions of times per day).

source

Sort:hotnew top

jormaig@programming.dev ⁨1⁩ ⁨year⁩ ago
But the thing is that you should never have access to the plaintext password and thus you should never be able to receive it in an email. You should store the salted hash of the password instead of the password itself.

source
- 8ace40@programming.dev ⁨1⁩ ⁨year⁩ ago
  These kind of forums don’t store the plaintext password, they send an email while in memory, and hash them afterwards. Still bad security, but it’s not storing it in plaintext.
  
  source
  - Miaou@jlai.lu ⁨1⁩ ⁨year⁩ ago
    It’s storing it in at least one third party’s database. Indeed, it’s not stored in plain text, it’s doing something much worse
    
    source
    sekhat@lemmy.temporus.me ⁨1⁩ ⁨year⁩ ago
    But you are supposed to change that generated password as soon as you use it to login. Now I have no idea about these forums, but you’d expect the software to enforce that need to change
    
    source
    -> View More Comments
  - jormaig@programming.dev ⁨1⁩ ⁨year⁩ ago
    But your password should never reach the server. It should be hashed already at the client and then salted at the server with a random hash. Then you store the salted hash
    
    source
JackbyDev@programming.dev ⁨1⁩ ⁨year⁩ ago
When I say “nitpicking the specifics” I mean OP is saying things like the password should never be unencrypted in memory in the same comment as mentioning things like the password in plaintext in the email and folks are more interested in browbeating over the first thing rather than acknowledging the second as a problem. I see this behavior far too often in tech spaces online. People are often more concerned with being pedantic and technically correct than anything else.

source
- Miaou@jlai.lu ⁨1⁩ ⁨year⁩ ago
  The person you’re responding is doing the exact same thing you are complaining about, and finished their comment with something obviously wrong. They are not arguing in good faith
  
  source