1

I tried to login to my college social network site but I forgot my password so I clicked the "Forgot Password" link then an email has been sent.
It stated in that email my username and the super duper clear text password.
By convention, a link will be sent to reset the password or a new password will be generated.
I think that my school has implemented Encryption and not Hashing or the Hash Mac.
They will be able to see my universal password in any time they want by decrypting using their key.
Is that completely legal?

Improve this question
2
  • 1
    Explain why you're using a universal password which in today's security environment is a really bad idea.
    – Fiasco Labs
    Oct 5, 2014 at 22:41
  • It's legal; its just a horrible idea
    – Ramhound
    Oct 6, 2014 at 0:10

2 Answers 2

Reset to default
1

There are a large number of standards related to security issues particular fields and types of services. Most of these standards include some information about how authentication credentials are supposed to be stored and kept secure. Failure to follow these standards can lead to legal problems.

Source

Improve this answer
0
0

Legal questions are for lawyers, not for SuperUser. However, it is their equipment, they can do what they want with it.

Improve this answer
2
  • so if I made a system and stored the passwords in clear text, then why study cryptography? What actions would you advice?
    – marion-jeff
    Oct 5, 2014 at 22:24
  • 1
    And the inference that the person creating the system studied cryptography is??? Anyway, this isn't the proper venue to discuss your college's social networking policy, that should be between you and other concerned students at that college that will have more political clout that can work directly with your school administration for change. It's not legality that you're worried about at this moment, but basic security and change there.
    – Fiasco Labs
    Oct 5, 2014 at 22:35

Not the answer you're looking for? Browse other questions tagged .