Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Follow the wormhole through a path of communities !webdev@programming.dev
Larian stated on their forum they fixed this behavior and shifted to https 3 years ago. When this was linked several times in thread, people asked OP when this screenshot occured, and OP ignored the questions. Pretty clear that this is a very old screenshot of what is now a non issue.
What's to discuss besides OP trying to stir up drama about issues that were resolved years ago?
this is a very old screenshot
What do you mean? It says "0 minutes ago"! Clearly it's very recent! /s
FWIW, it's not fixed. The screen shot may very well be recent.
(The post in question was still bad reporting, though, for the reasons I detailed in my other comment here.)
Are you saying that the parent poster is giving incorrect information?
Edit: Oy, straight from their membership administration docs (emphasis mine):
Additionally, using the buttons below, you can delete the user, email the user's password to him/her, (etc)
Are you saying that the parent poster is giving incorrect information?
Yes. mosiacmango's comment repeated what others had already said (right down to specific words that I used in the original thread and here), and then jumped to this conclusion:
Pretty clear that this is a very old screenshot of what is now a non issue.
Everything about that statement is false. While the circumstances made it seem likely that the screenshot was old, it was not clearly so, and in fact, it turns out the issue is still present. I checked it. A registration email from the test I ran yesterday looked just like the screenshot in question, cleartext password and all.
Given that Larian reported the issue fixed three years ago, it's possible that they fixed it locally and some time later upgraded to a new version of the forum software, thereby overwriting the local fix. Perhaps mosiacmango should have considered that before posting incorrect speculation as if it were fact.
Ouch... This should never be possible, in any world. If the password can be emailed, it can be seen. If it can be seen, it can be stolen.
Just wow, yeah. Nothing should ever send you a password in cleartext - once that's been done, a MITM attack's success rate just went to 100%.
It's painless to use password resets if the person forgot the password. Never, ever should a password be in cleartext.
hunter2
Why did you put a bunch of asterisks at the bottom of your post?
An issue if you’re reusing passwords. If not, every forgot my password email is also vulnerable.
A combination of bad practices could be… bad.
Edit: apparently around the same time, their forum was also lacking https. This would be an even easier vector.
It’s painless to use password resets
Ya and have they send you the (one-time) password in cleartext
(one-time)
You make it sound like an irrelevant detail, but that's kind of the key part. If implemented properly, it's only valid once and for a short period of time, which greatly reduces risk.
In my experience it's always a tokenized link, no clear text required.
Well, the tokenized link is essentially a clear text one time password. Not really any better than just a one time password except for the convenience that the user does not need to type it in. If someone gets hold of the link or password before you they can get access to your account.
I don't see how's either way better or worse as long as they force you to change the password upon login
And what is the token in the link?
Many years ago, I had forgotten my password to the Sprint websiteb so I could log in and pay my cellular bill. I had to call customer support to resolve this. After verifying my activity, the support agent read me my existing password one letter at a time. While this was alarming, I was amused she had to spell out a somewhat obscene phrase for me. This was maybe 20 years ago and I no longer use Sprint.
I no longer use Sprint
I mean, nobody else does either.
I think the OP of that post would have had a better reception if they had:
People in that thread responded with skepticism and criticism to an irresponsible, misdirected, misleading, alarmist mess of a post. That's hardly surprising.
This was hashed out pretty thoroughly in that thread.
The initial concern over the password being stored in plaintext was shown to be a mistaken assumption, and it was made clear that this kind of email doesn't happen anymore, it's an outdated problem.
No need to keep the discussion going past that, is there? Much less spread it around?
Sending passwords via email Will compromise any passwords sent via email. Regardless if the password is stored anywhere in the process if the password is sent via email it is compromised and no longer safe to use. Email is not end and encrypted you have no idea who's running the mail exchange servers that your email follows, it's entirely possible for this company to store that password in a log dealing with their email servers. Password sent via email should be considered immediately compromised and any sites following a practice like this should not be trusted with standard passwords which you shouldn't be using anyway.
Right, and everyone agreed that wasn't the greatest practice. Two years ago.
This thread from two days ago was bringing attention to an issue that was fixed two years ago, and calling it out as if it was a different problem than it was.
It's good to have discussions about security best practices, but this thread is pointless. This problem is simply not there anymore.
Email isn't end to end encrypted but, but it generally is encrypted. The people who will have it are the sender (who already have the password since they created it) and whoever runs the recipient's mail server. Which is hopefully someone the recipient trusts.
From the sounds of it, this was a password that the server randomly generated, so it's never been used before, and you are forced to reset the password as soon as you use it, so it'll never be used again and they do treat it as "immediately compromised".
Hardly state of the art security, but it also doesn't really have any major problems... especially since this is for a forum.
hashed out
heheh
People weren't really nitpicking.
Everyone seems more interested in nitpicking the specifics of what OP is saying and are ignoring [the actual point]
This is the experience working in a professional software development setting, yes.
Everyone seems more interested in nitpicking
Actually, not everyone in that thread is nitpicking. There's one comment that's just a helpful hint.
But yes, nitpicking is fun. I'll see myself out.
No, I'll allow it, this is a good post. Not even being sarcastic, did me a grin haha
Uh, I seem to recall this happening when I made a Larian account. What happens is you give them your email, they make your account, and email you a temporary password. The temp password is shown in plaintext, as the email shows. Once I saw the email, I logged in to finalize my account and change my password to something secure. It's not the most modern process, but I wasn't really that concerned either.
OP of that thread was talking about how (they think) the password was stored in plain text instead of this "tree" you're talking about. The discussion on that was not a nitpick.
The number of people accepting email for some magic thing without in-between mechanisms is ridiculous. If it's sent in an email you should 100% consider it to be stored in plaintext in multiple places. There is incredible amount of machinery between your mail() call and the end user reading that email, on both the sending and receiving end. For example, my spam filter (rspamd) will likely store a copy of it for a while, and that's not unique to it.
What's in the database is not really relevant. Only the worst instance of storage counts.
Everyone seems more interested in nitpicking the specifics of what OP is saying
Yep. That's how security works. You have to nitpick the specifics.
The reality is nobody has invented a perfectly secure authentication system that is easy to use (for example, allows easy recovery when people forget their password which for any large service will be tens of millions of times per day).
Attempts have been made - passkeys being the latest one - but they're not even remotely easy to use as soon as you step slightly out of the most common path (such as using the web browser that is provided by the company you're logged in with... try to use Chrome with an Apple passkey, or Safari with a Google passkey, and you're going to stumble into usability issues).
Passwords are not considered secure wether they're sent in a plaintext email or not. They can be secure, if used properly, but 99% of users don't follow best practices. As a result almost every web service in the world is insecure and it's the nitpicky details that matter.
Sending a secret to an email address is a standard step during registration for almost any service.
But the thing is that you should never have access to the plaintext password and thus you should never be able to receive it in an email. You should store the salted hash of the password instead of the password itself.
These kind of forums don't store the plaintext password, they send an email while in memory, and hash them afterwards. Still bad security, but it's not storing it in plaintext.
The only issue I can see is why are you sending the password to the person in the email at all just seems redundant... I think I may have run into a tree though.