Well I do NOT want to see my password in mail you send me

[(void*)0]

Hello,

I just registered my new account and when I opened my confirmation mail, guess what? i found my password there in open plain text.

Well, that's not good. It tells me that you store my password in your database, instead of hashing it, and then you send it over the internet? This is my light-weight password and I use it for practically every non critical logon on the internet like forums, etc.

Sorry for complaining, but I just got angry looking at my password in the confirmation mail. I was looking at it alone, but what if I wasn't?

So IMHO if you store the plain password in the database (bad practice I think), then you should provide a random password instead of asking the user for one. And IF you ask the user for a password that you are going to store in the database and send around in emails, then you should tell him about that in big bold red letters size 24 directly next to the password field.

How many users do you probably have in this forum who provide the same password they use for the email-account they provide in here? What happens if a bad intended person gets to that data? He can read all of their mail, without even being noticed.


PS: This is my second tron identity I am registering here. I wouldn't tell which is the other one, but if you are curious, just run a select query with my password and take a look who shows up in the result... (admins only of course)

[epsy]

I agree, and am looking at phpbb people on that one. But passwords aren't stored in cleartext, they're just sent around in e-mails cleartext.

[(void*)0]

Ok, I apologize for being so upset. I am glad to know it's not in the database. I hope they use some irreversible hash for it - it's hard to be trustful after seeing my password in a mail... and it's just plain stupid - who would ever forget that password after typing it twice in the registration form and before reading the mail a few seconds later...

[Word]

me



happened already

[kyle]

Well, that's not good. It tells me that you store my password in your database, instead of hashing it, and then you send it over the internet? This is my light-weight password and I use it for practically every non critical logon on the internet like forums, etc.

That's the real bad practice. Once you get phished, everything changes. But password's are hashed in DB

[(void*)0]

I know it's bad practice. But as I said, it's non critical bad practice. But how many users are out there who use this practice on critical accounts? Developers should always protect their uninformed or careless users.

[(void*)0]

me



happened already

sorry I forgot about you...

[Tank Program]

Yeah... this has bothered me a bit before as well. So now it won't happen. Don't forget your password!