Comments

• AlmightySnoo@lemmy.world ⁨1⁩ ⁨year⁩ ago

  That doesn’t really mean that they store it in plain text. They sent it to you after you finished creating your account, and it’s likely that the password was just in plain text during the registration. The question still remains whether they store their outgoing emails (in which case yes, your password would still be stored in plain text on their end, not in the database though).

  source

  • ono@lemmy.ca ⁨1⁩ ⁨year⁩ ago

    Your guess is confirmed here.

    There are plans to update the forum, including for better security (the main issue with changing the forum software is concern over reliably migrating all of the existing content). After emailing (admittedly not current best practice), the passwords are hashed and only the hash is stored.

    Also, no, the password would not necessarily still be stored in plain text on their end. The cleartext password used in that email might be only in memory, and discarded after sending the message. Depends on how the UBB forum software implemented it.

    source

    • Asudox@lemmy.world ⁨1⁩ ⁨year⁩ ago

      It is still a bad idea to send the password in plaintext via email.

      source

      • -> View More Comments
    • Cabrio@lemmy.world ⁨1⁩ ⁨year⁩ ago

      OP would do well to responsibly report it, rather than stirring up drama over a web forum account.

      ¿Porque no los dos?

      Took them 23 years to fix it last time, seems public awareness would be important in the interim, no?

      source
  • Cabrio@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Yes, still not worth risking using a duplicate password though.

    source

    • finestnothing@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Honestly, why risk duplicate passwords even then? I have one strong password that I use for accessing my password manager, and let the password manager generate unique random passwords. Even if I had an easier password that I duplicated with some small changes, I’d still use a password manager to autofill it anyway. I use bitwarden personally, you can also self host it with vaultwarden but it seemed like more trouble than it was worth imo

      source

      • -> View More Comments
    • wahming@monyet.cc ⁨1⁩ ⁨year⁩ ago

      Applies to every site ever

      source
  • trustnoone@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

    I actually think this is the case. I could be completely wrong but I swear I saw the same question like 6 years ago in another forum software that looks exactly like this one lol. And people compalined about it storing plain text, but the response when asking the forum people was that it was only during that password creation, it’s not actually stored.

    I don’t know if it’s crazy for me to think it’s the same forum from that many years ago, still doing the same thing and getting the same question.

    source
  • glad_cat@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

    We all know that they store it in plain text.

    source
  • ryannathans@aussie.zone ⁨1⁩ ⁨year⁩ ago

    Came here to say this

    source

    • ARk@lemm.ee ⁨1⁩ ⁨year⁩ ago

      Well you’re late

      source

      • -> View More Comments
• nickwitha_k@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

  That’s very unlikely. It’s running UBB Threads, which, from what I can tell, has an auth subsystem, which au minimum would do hashing. If it’s providing you with a default at sign-up, that’s different and is what appears to be a configurable setting.

  If it is completely generated for you, here’s what probably happening:

  1. User creation module runs a password generator and stores this and the username in memory as string variables.
  2. User creation module calls back to storage module to store new user data in db, including the value of the generated password var.
  3. Either the storage module or another middleware module hashes the password while preparing to store.
  4. Storage module reports success to user creation.
  5. User creation module prints the vars to the welcome template and unloads them from memory.

  TL;DR as this is running on a long-established commercial php forum package, with DB storage, it is incredibly unlikely that the password is stored in the DB as plaintext. At most it is likely stored in memory during creation. I cannot confirm, however, as it is not FOSS.

  source

  • Cabrio@lemmy.world ⁨1⁩ ⁨year⁩ ago

    It sends the user generated password, not an auto generated one.

    source
• vox@sopuli.xyz ⁨1⁩ ⁨year⁩ ago

  no, they dont.
  they just send it to your email upon registration.

  source

  • Mirodir@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago

    …and if they keep the emails they send out archived (which would be reasonable), they also have it stored in plaintext there.

    source

    • Thadrax@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Automatically generated emails usually don’t get saved.

      source

      • -> View More Comments
  • tb_@lemmy.world ⁨1⁩ ⁨year⁩ ago

    But that still means they had your plaintext password at some point.

    source

    • vox@sopuli.xyz ⁨1⁩ ⁨year⁩ ago

      hashing on client side is considered a bad idea and almost never done.

      source

      • -> View More Comments
    • Kilamaos@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Of course. You receive the password in plain on account creation, do the process you need, and then store it hashed.

      That’s fine and normal

      source

      • -> View More Comments
  • dangblingus@lemmy.world ⁨1⁩ ⁨year⁩ ago

    I’ve literally never had a service provider email me my own password ever. Maybe a OTP, but never my actual password. And especially not in plaintext.

    What would be the necessity behind emailing someone their own password? Doesn’t that defeat the purpose of having a password? Email isn’t secure.

    source

    • wim@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

      I find that very hard to believe. While it is less common nowadays, many, if not most, mailing list and forum software sent passwords in plaintext in emails.

      A lot of cottage industry web apps also did the same.

      source

      • -> View More Comments
    • benjacoblee@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Idk if I’m misremembering, but it’s my impression that they did this a lot in the 2000s, haha. I guess bad practices have a habit of sticking around

      source
    • EssentialCoffee@midwest.social ⁨1⁩ ⁨year⁩ ago

      I’ve had service providers physically mail my own password to me before. Just crazy.

      Always use unique passwords for every site.

      source
  • TheEighthDoctor@lemmy.world ⁨1⁩ ⁨year⁩ ago

    So it’s in plaintext in their email system

    source

    • Thadrax@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Generated emails usually don’t get saved, as soon as it is delivered it will be gone.

      source
    • vox@sopuli.xyz ⁨1⁩ ⁨year⁩ ago

      these emails don’t usually get copied to local outbox folder (as any oher auto generated emails)

      source
• inclementimmigrant@lemmy.world ⁨1⁩ ⁨year⁩ ago

  While sending your password in plaintext over email is very much a bad idea and a very bad practice, it doesn’t mean they stole your password in their database as plaintext.

  source

  • jeeva@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Would you accept “in a way that can be reversed”?

    source

    • tonkatwuck@lemmynsfw.com ⁨1⁩ ⁨year⁩ ago

      It’s possible that this email is a result of forum user creation, so during that submission the plaintext password was available to send to the user. Then it would be hashed and stored.

      source

      • -> View More Comments
  • Serdan@lemm.ee ⁨1⁩ ⁨year⁩ ago

    Passwords shouldn’t be stored at all though 🤷‍♂️

    source

    • Vlixz@lemmy.world ⁨1⁩ ⁨year⁩ ago

      You mean plaintext passwords right? Ofcourse then need to store your (hashed)password!

      source

      • -> View More Comments
• jonne@infosec.pub ⁨1⁩ ⁨year⁩ ago

  Sending your password right after you created it might not be best practice, but it doesn’t mean it’s stored unhashed in the database. It looks like they’re using a third party forum software, so it should be pretty straightforward to figure out whether they do or not.

  source

  • AlmightySnoo@lemmy.world ⁨1⁩ ⁨year⁩ ago

    it should be pretty straightforward to figure out whether they do or not

    Not really since it’s closed-source: www.ubbcentral.com

    But they seem to have been in business since 1997, so I highly doubt that they’d fuck up the “never store passwords in plain text” rule.

    source

    • jonne@infosec.pub ⁨1⁩ ⁨year⁩ ago

      Yeah, I was looking it up, and when I saw they’ve been selling this forum software since 1997 I was less confident about passwords being hashed. They address it in their forums and they’re making it clear that the passwords are actually hashed, and they’re looking at migrating to other solutions regardless.

      source

      • -> View More Comments
• hperrin@lemmy.world ⁨1⁩ ⁨year⁩ ago

  You can also tell if a site does this when they have seemingly arbitrary restrictions on passwords that are actually database text field restrictions.

  Especially if they have a maximum password length. The maximum password length should be just the maximum length the server will accept, because it should be hashed to a constant length before going into the database.

  source

  • icedterminal@lemmy.world ⁨1⁩ ⁨year⁩ ago

    I recently created an Activision account during a free weekend event and discovered their password system is completely broken. 30 character limit but refused to accept any more than 12 characters. Kept erroring out with must be less than 30. Once I got it down to 12 it accepted that, but then it complained about certain special characters. Definitely not giving them financial information.

    source

    • Darkassassin07@lemmy.ca ⁨1⁩ ⁨year⁩ ago

      My bank has a character limit, but they don’t tell you about it; they just trim the password you’ve set before hashing + saving it, then when you go to login if you don’t trim your password the same way they did, login fails.

      I only know this because the mobile app will actually grey out the login button as soon as you enter more than the character limit. The web app just leaves you to be confused.

      source

      • -> View More Comments
  • exal@lemmy.ca ⁨1⁩ ⁨year⁩ ago

    Especially if they have a maximum password length.

    Not really, there are good reasons to limit password length. Like not wanting to waste compute time hashing huge passwords sent by a malicious actor. Or using bcrypt for your hashes, which has a 72 byte input limit and was considered the best option not that long ago. The limit just has to be reasonable; 72 lowercase letters is more entropy then the bcrypt hash you get out of it, for example.

    source

    • hperrin@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Yes, reasonable limits are fine, I was talking more like 12 or 13 characters max. That’s probably indicative of a database field limit, and I’ve seen that a fair amount because my password manager defaults to 14 characters.

      source
• slazer2au@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Set your password to an EICAR test string and see what else you can brick on their site.

  source

  • CurlyMoustache@lemmy.world ⁨1⁩ ⁨year⁩ ago

    This comes to mind

    source
  • sysadmin420@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Holy shit beautiful. Now I wanna try it everywhere

    source
• 1984@lemmy.today ⁨1⁩ ⁨year⁩ ago

  It’s 2023, I really hope people are not using the same password in multiple places. Password managers solved this problem a decade ago. Use one. :)

  source

  • Honytawk@lemmy.zip ⁨1⁩ ⁨year⁩ ago

    There are people who purposely forget their passwords, so they use the “forgot my password” link every time they need to login.

    Hard to hack them.

    source

    • 1984@lemmy.today ⁨1⁩ ⁨year⁩ ago

      Yeah some sites also dont have passwords, they just send a login link to your email every time.

      I prefer passwords so I don’t have to go to my email to log in, but I understand it’s easier for some people to do it that way. Your email address becomes your identity then.

      source
  • Kolanaki@yiffit.net ⁨1⁩ ⁨year⁩ ago

    I’ve used the same password for everything since 1991. If anyone’s cracked it, they haven’t attempted to get into my shit. Probably because there’s nothing worthwhile to steal.

    source

    • mojo@lemm.ee ⁨1⁩ ⁨year⁩ ago

      Bro that’s dumb as hell

      source

      • -> View More Comments
    • gornius@lemmy.world ⁨1⁩ ⁨year⁩ ago

      “I’ve never had covid, so it doesn’t exist” vibes.

      source
    • 1984@lemmy.today ⁨1⁩ ⁨year⁩ ago

      If you dont care, just give me your password then. :)

      source

      • -> View More Comments
    • Nibodhika@lemmy.world ⁨1⁩ ⁨year⁩ ago

      First of all they wouldn’t know there’s nothing worthwhile until they got in. But most importantly if you’re using the same password for everything since 91 there’s around a 0% chance that password hasn’t been leaked. This means that a random person can have access to everything that you have that’s not 2fa protected without you even noticing. You said that no one tried to get into your things, how would you know? Most places don’t let you know when someone login successfully, and a lot of other places do so with an email which the attacker can quickly delete.

      If you really use the same password for everything since a long while back anyone who knows your email address can get into anything yours, getting a hold of one of those password dumps is really easy, especially older ones.

      source

      • -> View More Comments
• Krakatoacoo@lemmy.world ⁨1⁩ ⁨year⁩ ago

  For those who haven’t made accounts yet, you don’t actually have to make an account to play Larian Studios games.

  source
• Miclux@lemmings.world ⁨1⁩ ⁨year⁩ ago

  [deleted]

  source

  • lwuy9v5@lemmy.world ⁨1⁩ ⁨year⁩ ago

    what a stupid comment

    source

    • Miclux@lemmings.world ⁨1⁩ ⁨year⁩ ago

      Show me where the proof is that they STORE it plain text. This is just a screen of a mail after creating an account.

      source

      • -> View More Comments
• Dremor@lemmy.world ⁨1⁩ ⁨year⁩ ago

  This post is pending mod review

  Hello, c/Games mod here.

  For everyone infosec culture, hashing and salting password consist in using one-way mathematical functions to encrypt passwords. It is a very commonly used security practice to make it more difficult for an attacker that was able to steal a database to obtain the password. As the website is unable to decrypt said password (thank to the one way mathematical function), the only way to send you back your password in this manner is to have it unhashed and unsalted in his database.

  But

  In the current case, this is a registration email, which may have been sent before the initial hashing and salting. In this case we cannot say for sure if Larion Studios indeed have unhashed and unsalted password in his database.

  We will review this post later today as it is arguably breaking Rule 1 and Rule 4, as well as being incorrect. in the meantime it will stay up with this pinned message.

  source