News for hackers. Stuff that matters.
Re:Ask HN: The correct way to email users their PLAINTEXT pa... by byoung2 on Monday January 16, 2012 @09:42AM (#3470751)
I just expereienced this a few days ago. I had some domains registered with an old shared hosting company that were up for renewal. I the few years since I last logged in, the company had been bought by a new company, so when I went to the website, I was redirected to the new site. I clicked the forgot password link and got an email with my password in plain text. It was so jarring to know that a web host and domain registrar would hold the keys to several domains (including the one that houses my email domain) in plain text. I transferred all of my domains to a new registrar who encrypts passwords.

I would advise sending anyone a plain text password, because when you do, they will realize that not only did the old company store them that way, they also transferred them to a new company in plain text.

There are no comments on this comment yet.