News for hackers. Stuff that matters.
Re:How I Lost My $50,000 Twitter Username by Achshar on Wednesday January 29, 2014 @08:25AM (#7143632)
Kind of off topic but that site also shows sites that email users their password when they create the account. That does not necessarily mean they store it plain text. Though the kind of devs that would send the password in email are likely to store it in plain text, but it's not necessary.
Re:How I Lost My $50,000 Twitter Username by Steuard on Wednesday January 29, 2014 @09:21AM (#7143933)
If you send the password in email, that's at least one instance where it was readable in clear text to everyone on the network between you and the server (and probably things like packet sniffers on the local network, right?). It's not as bad as storing it in the clear, but it removes some of the value of (e.g.) hosting a login page via SSL.
Re:How I Lost My $50,000 Twitter Username by aestra on Wednesday January 29, 2014 @09:27AM (#7143958)
Shouldn't email plaintext passwords, ever. Email is not a secure way of communication. Users wouldn't delete their email. Admins can read their email from the server.
Re:How I Lost My $50,000 Twitter Username by blueskin_ on Wednesday January 29, 2014 @09:41AM (#7144036)
Email is rarely secure though.

A password reset link that emails a temporary password is OK in my opinion (not ideal, but a tradeoff for password resets, and perfectly fine if the site actually forces a change on logging in with it), but "Thanks for registering, your password is foo" is not, as then the user has to change it (and some exceptionally bad sites may then email them that password as well).

Re:How I Lost My $50,000 Twitter Username by redblacktree on Wednesday January 29, 2014 @10:43AM (#7144469)
It does mean that passwords aren't properly hashed. They may be encrypted, but that still leaves open the possibility for an engineer or attacker to have access to plain text passwords.
Re:How I Lost My $50,000 Twitter Username by arjie on Wednesday January 29, 2014 @11:46AM (#7144981)
No, it does not. You can receive the password, email it to creator, hash it, and then store it. It's not ideal because you now expose it in plaintext in the original email, but you aren't storing plaintext.
Re:How I Lost My $50,000 Twitter Username by redblacktree on Thursday January 30, 2014 @11:36AM (#7151549)
You're right. I missed the "when they create their account" part.
Re:How I Lost My $50,000 Twitter Username by gog on Wednesday January 29, 2014 @11:50AM (#7145016)
No it doesn't, the registration email can be sent before the password is hashed.