When a site emails your old password, as opposed to requiring you to reset it on the site, I'm wondering what that implies about their security measures.

Does this mean that they store the password in plain text for their own convenience or could they still use encryption on the password?

  • Related to this question - superuser.com/questions/46810/… – ChrisF Sep 25 '09 at 16:21
  • 3
    Encryption is a two-way process where you somehow can decrypt the information given the correct key. Passwords should normally use hashing instead which in theory is a one-way coding where the password results in a specific hash value - which is hard or impossible to reverse. When you then login, your entered password is coded in the same way and compared to the stored coded value and lets you in if they match. In practice you can sometimes reverse the process through various brute-force processes like using rainbow tables... – Oskar Duveborn Sep 25 '09 at 17:35
  • 2
    Whether or not they had it had it encrypted, they sent it in a plan-text email! That website is not serious or clued-in about security in any way. Hopefully you didn't give them a password that you use anywhere else. Right? – DanO Oct 30 '09 at 22:24
  • I abandoned a site because they insisted on e-mailing me my username and password once a month, whether I asked for it or not. I e-mailed them several times to tell them that this was not good practice, then gave up. – TRiG Jun 20 '11 at 11:40

They might be using encryption when the password is stored in the DB but they shouldn't be storing it in a retrievable format at all, encrypted or otherwise.

They should be taking a one-way hash of the password (plus a salt). This means they can check the password you enter now matches the one you gave before but they (or some cracker with access to their DB) cannot find out what it is. Encrypting the password means a cracker would have to find the DB and the encryption key, but since the key must be on the server serving the website this is hardly inconceivable.

So if they can send you your password this means they are not following well known security best practices.

Bad practice like this is a good reason for using a different password for every website you register at.

  • 9
    BTW, thanks for calling them crackers instead of hackers ! – NVRAM Sep 25 '09 at 16:44
  • As an aside, two-way hashes are considered by major banks to be secure enough for storing credit card information. – runako Sep 25 '09 at 19:41
  • 1
    @runako: What's a two-way hash? A hash function usually yields a value of a certain size, which means that the original can't be found again unless the original is no larger than the hash value. – David Thornley Sep 25 '09 at 19:44
  • 1
    Sorry, mis-post. That should have been "two-way function". – runako Sep 25 '09 at 20:20

Even if it is encrypted and secure, that e-mail was in no way secure.

One thing you do know, by using e-mail, your password is now almost
certainly stored in plain text at many other locations:

  • On their mail server
  • On your e-mail provider's server
  • In your computer's browser or e-mail storage directories
  • On the hard drive/logs of anyone who might have been "listening in" along the way
  • ...and quite possibly at any Internet hop between you and that site.

As Dave said, they could and hopefully are using encryption, but I have seen sites that store passwords in plain text. They could also generate a new temporary password when you hit the I forgot my password button, that you have to change the first time you login with it. The bottom line is you don't know how they store your password and unless the site is hosted by the same company that you get support from, and they only have a few people it is unlikely that you would be able to ask anyone that would know how it is stored, and even if they did know it is unlikely they would tell you.


The answer is NO - this isn't a proof of anything.

In any case, you have no way of knowing how the passwords are stored internally. Most likely they are using a database like mysql, and it might be that they are not encrypted inside the database. However, it's still possible they are consciously storing the entire database in some encrypted media such as TrueCrypt. All you can do is hope that they have taken enough measures to protect your privacy.

  • 6
    It is proof that they aren't stored encrypted with a one-way hash, and hence the plain text password can be retrieved. – NVRAM Sep 25 '09 at 16:45
  • 1
    Retrieved is not the same as plain text. Retrieved can also mean decrypted. Plain text means stored as simple text that one can display without much effort. – harrymc Sep 25 '09 at 16:58
  • 1
    If it can be decrypted then it's not secure. Take over the authenticating box and you have the keys to decrypt everyone's passwords. – Jeremy L Sep 25 '09 at 18:39
  • 1
    Yah, take over the site server and you can log passwords even before they are one-way hashed. Come on guys, you are being silly. – harrymc Sep 26 '09 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.