1

I used to login into a certain website a couple of years ago. Recently I've got an email suggesting that I should renew my membership, and that email included my old password. That's right, my old password was emailed to be verbatim over SMTP.

That implied two things:

  1. They store passwords as unencrypted text rather than one-way hashes, which makes all current and former members' information very vulnerable.

  2. They send around those passwords in unencrypted emails, which makes their members' information extremely vulnerable.

So I went on your website to see whom to contact regarding fixing these security bugs, and, to my surprise, found these gaping security holes were there by design! Specifically, I clicked the button to remind me my password and got this email:

You, or someone posing as you, has requested a password reminder for your membership on the mailing list "the website".

....

You are subscribed with the address: "my email, unencrypted"

Your "the website" password is: "my old password, unencrypted"

So sent an email to the webmaster listed on the site; unfortunately the email bounced back as undeliverable. I am not employed at that site, but I find is difficult to ignore the issue because that would be leaving thousands current and former users very vulnerable. The website is not a local general store, it belongs to a well-known (among software engineers) lab at a major university and may have thousands of user accounts.

Thus the question: what further steps can/should I take to improve IT security there?

Gilles 'SO- stop being evil'
  • 50,912
  • 13
  • 120
  • 179
Michael
  • 113
  • 4
  • 6
    Since you are not employed there you can probably only do [public vendor shaming](http://plaintextoffenders.com/) and hope that it gets better. But I propose to close this question because it is primarily opinion-based. – Steffen Ullrich Feb 17 '17 at 17:39
  • Was your old password auto generated or one that you created? – TTT Feb 17 '17 at 17:48
  • 1
    Closely related: [Reference for Insecure password by email](http://security.stackexchange.com/questions/41179/reference-for-insecure-password-by-email) – Gilles 'SO- stop being evil' Feb 17 '17 at 18:00
  • 1
    Don't use it anymore? – oɔɯǝɹ Feb 17 '17 at 18:17
  • 1
    You can find a technical contact email on the whois register. You could try them if the webmaster contact is bouncing – iainpb Feb 17 '17 at 20:22
  • Well one thing is for sure .... you should use DIFFERENT passwords on each website. Thus you are protected from the security profile of one site affecting your information on other sites. – mdpc Feb 17 '17 at 20:46

0 Answers0