147
OP finds vulnerability where a forum sends you your password in plaintext over email and everyone misses the forest for the trees (lemmy.world)
submitted 2 years ago by to c/programming@programming.dev
83 comments fedilink hide all child comments
 

This thread is frustrating. Everyone seems more interested in nitpicking the specifics of what OP is saying and are ignoring that a forum sends you your password (not an automatically generated one) in an email on registration.

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 2 years ago* (2 children)

It’s painless to use password resets

Ya and have they send you the (one-time) password in cleartext

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 2 years ago (3 children)

    In my experience it's always a tokenized link, no clear text required.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 15 points 2 years ago

    Well, the tokenized link is essentially a clear text one time password. Not really any better than just a one time password except for the convenience that the user does not need to type it in. If someone gets hold of the link or password before you they can get access to your account.

  • permalink
  • fedilink
  • source
  • parent