Hacker News Reader

I gently agree. To be fair to the site, they do mention (admittedly on the bottom of the about page)

> More reading on why even _just sending the password_ via email without storing it in plain text is bad.

Which has a hyperlink to

(http://plaintextoffenders.com/post/7006690494/whats-so-wrong...)

> What's so wrong about sending a new password in plaintext? It doesn't mean that the password is saved in plaintext...

View on HN

Ironically enough, I went to log in to HN specifically to upvote comments in this thread, forgot my password and had to use the 'email yourself a new password' function.

Granted, it sends a randomly generated password. And granted: it's probably meant for one-time use only (I presume). However, logging in with the new password does not automatically prompt (or even force) to change it to something of my own choosing. Result: hit 'remember password' in Chrome and forget about it. Now my active HN password is in my inbox, in plain text.

Reply on news.ycombinator.com