Hacker News Reader

Comment by damon_c | Hacker News Reader

Last time I interacted with Magento, one of their customer service people verified my plain text login password over the phone.

edit: (it was about 5 years ago)

View on HN

I honestly don't know how that's possible, as right from the start Magento used a (very crappy) MD5+SALT scheme for password encryption.

Here's a 2013 version of their password hashing file[1] which should confirm that they were using the (very crappy) method back then.

OSCommerce, which Magenta was attempting to replace, had password hashing as far back as 2006.

Maybe you're thinking of a different service?

1. https://github.com/nexcess/magento/blob/master/app/code/core...

I know it sounds implied but he didn't say customer service had access to plain text password, just that he verified it over the phone. You can surely do that with hashed password but it's still not a good practice.

I was not enjoying Magento and my password was something like "MagentoSuck$"

I don't remember who I was talking to exactly but they said something like "and you're logging in with the username <whatever> and the password (fading awkwardly) MagentoSucks..."?

And we both kind of laughed nervously...

"Last time I interacted with Magento, one of their customer service people"

That sounds to me more like they were dealing with the Meganto support portal rather than the Magento ecommerce software itself - a quick peek right now suggests that's Zen Desk. I don't know if ZenDesk admins have access to cleartext user passwords, or if Magento's ZenDesk agents regularly ask people for passwords and have a means of verifying them - but it's not a good look either way.

A default Magento 1.* install emails a plain text copy of a users password upon account creation.

https://raw.githubusercontent.com/OpenMage/magento-mirror/ma...

Reply on news.ycombinator.com