Password!

[tiedyeina]

Hello I'm new and shiny and cellophane wrapped.

Also when I just registered my password was emailed to me in plaintext. Terribly bad form. Could you chaps stop doing that?

Byeeeeeeee

[headprogrammingczar]

This is, by far, the best thread in S/FI. I can imagine it wouldn't be too hard to correct, and plaintext passwords are really bad form.

[Gordon]

Would you propose a new delivery method, or just skipping the confirmation email / leaving the password out of it?

The people with the power to reset passwords are most likely not going to reset passwords for people who forget theirs, or were counting on the email to keep with their records.

[suffer-cait]

what other kinds of text are there?...

[b.i.o]

what other kinds of text are there?...

It could be encrypted (plaintext vs. cyphertext) , or it could just not be sent at all (which is the approach many websites take).

[Gordon]

tiedyeina: Lay out your reasoning / thought pattern as to why the board emailing out the password in plain text is 'poor form' or whatever expression you used. Then suggest alternatives and why they are better.

[phlip]

If you want phpBB to not send out your password, one would think the best people to suggest it to would be the people who make phpBB.

As it stands, if you're that concerned about having your password sent in the clear across the Internet one extra time (in addition to when you signed up and every time you log in, of course), then feel free to change it... after testing it with Science, it has been revealed that that doesn't send the new password in an email.

[b.i.o]

tiedyeina: Lay out your reasoning / thought pattern as to why the board emailing out the password in plain text is 'poor form' or whatever expression you used. Then suggest alternatives and why they are better.

It's poor form because someone could theoretically be recording/looking at data that's being sent and find your password out. However, the chances of that happening are hovering somewhere around none.

The primary alternative would be not sending the password in the e-mail at all and having people write it down themselves as they need to. This may or may not be a phpBB option, I can't remember--if it's not, you're a lot better off talking to the phpBB people than asking here (as phlip said).


The other thing, though, is that the sign in here is via http, not https, so I really don't think not having a plaintext password e-mailed is going to buy you much.

[Gordon]

Thank you this is what I was waiting for:

It's poor form because someone could theoretically be recording/looking at data that's being sent and find your password out.

If anyone is concerned about someone finding out your password to these forums ... what is it you think we do around here?

[runa]

If you want phpBB to not send out your password, one would think the best people to suggest it to would be the people who make phpBB.

You can actually disable that. But if a user clicks on the "I forgot my password"-button a new password will be sent, in plaintext, to the users email address.

[b.i.o]

Thank you this is what I was waiting for:

It's poor form because someone could theoretically be recording/looking at data that's being sent and find your password out.

If anyone is concerned about someone finding out your password to these forums ... what is it you think we do around here?

Ya know, I had the second sentence there for a reason.