Hacker News Reader

Comment by level09 | Hacker News Reader

and how would you go about checking that ?

I would wager they've done a "forgotten password" action and were sent their original password, always a dead givaway. Doesn't mean they're not encrypted in the database, but that's not good enough either.

2 reasons... 1. Letters of my password are shown to me with asterisks inbetween.

2. users used to get their own password sent back to them when they forgot it, rather than being forced make a new pass.

Although to be fair I don't think they do 2 anymore

You only have to google it to find other users saying the same thing.

For a long time it actually sent you your password in an automated email once a month just in case you happened to forget it.

Interesting. If you were to do that, it'd be much easier to send a login link.

This attitude might actually be the difference between them and lesser known competitors. (not that I think it's OK)

Well, really, I think the big difference at the time was just that it was free. OKCupid was a later followup on the same idea, but most dating sites at the time were pay-to-message at best.

You find very different people on PoF than on the pay dating sites. Or even than on OKC, which forces you to expose more of yourself to become visible.

When this originally came up people were saying that, they use it as a reminder to keep using the site. But you can get the same benefit using a login link or something, no need for all the security issues.

Yep.

The email itself is actually a call to action, it's telling you your new matches. And it's actually weekly. It looked like this before:

    Hello yournamehere,

    Thank you for signing up on MM/DD/YYYY HH:MM:SS XM.
    Remember your password is *****.

    http://www.plentyoffish.com is larger than all other free dating sites combined.

    View your latest matches here --> http://www.plentyoffish.com/viewmatches.aspx

    1. You can now easily check your messages via a cell phone.
    2. Latest signups -- > http://www.plentyoffish.com/lastsignup.aspx
    3. Users online in your city -- > http://www.plentyoffish.com/lastonlinemycity.aspx
    4. If you have found your match you can delete your account in the help menu.
    5. Read your new emails here --> http://www.plentyoffish.com/inbox.aspx
    6. Who checked out your profile? -->http://www.plentyoffish.com/whoviewedme.aspx
    7. Compatibility Test to Measure Chemistry --> http://www.plentyoffish.com/poftest.aspx

    http://www.plentyoffish.com

At some point the password line was just replaced with:

    http://www.pof.com is larger than all other free dating sites combined.

So they didn't even have to make it a login link.

They might be storing only those shown letters in plain text, with the actual password being hashed.

That was my thought at first, but it seemed a coincidence the number of Astericks matched my actual password

Im speculating but it could be that the password reset emails you your password, or the signup notification includes your email/password.

I am guessing they do a 'forgot password' that returns it in cleartext?

Reply on news.ycombinator.com