Re:Double Blind Passwords a.k.a. Horcruxing
by Thorrez on Tuesday December 22, 2020 @11:44AM
(#25508181)
For 2, if it's a password that the user chose, the site should never email it, because the user likely reused that password across many sites, and someone who snoops on the user's email (say a housemate) can get the password to a ton of sites.
If it's a password generated by the site, then it's actually fine to email it. Although you likely don't want it too early in the email that it would show up in a phone notification or in a body summary in gmail.
Re:Double Blind Passwords a.k.a. Horcruxing
by GoblinSlayer on Tuesday December 22, 2020 @02:49PM
(#25510342)
Many sites are wrongly listed there, like https://plaintextoffenders.com/post/629608281322733568/qnx-s...
Re:Double Blind Passwords a.k.a. Horcruxing
by 101008 on Tuesday December 22, 2020 @07:43AM
(#25505693)
Honest question: If you send it on the email without storing (just sending appending the $password variable to the email body), what would be the problem?
Re:Double Blind Passwords a.k.a. Horcruxing
by UncleMeat on Tuesday December 22, 2020 @08:02AM
(#25505809)
Some email is still sent unencrypted over the web so people snooping on traffic could see it.
Re:Double Blind Passwords a.k.a. Horcruxing
by GoblinSlayer on Tuesday December 22, 2020 @02:50PM
(#25510361)
Not hypothetical https://plaintextoffenders.com/post/628974096028434433/movis...
1) A site that emails you your password might not be storing it in plain text. They're similar but separate problems.
2) A site that sends you a login link could be just as bad as the sites listed here, if that login link doesn't expire (and you used a unique password). It's a more subtle way of having the same problem.