Hacker News Reader

Comment by gondo | Hacker News Reader

received email with password in plaintext after registration

I was just going to say the same thing. What the hell kind of group offers security and VPN services and then sends passwords plaintext!

They will need to store them in plain text or encrypted plain text (which is just plain text with sugar on top) just due to the way some of the VPN protocols they support work.

They should avoid emailing them however, if they can.

Not sure if it's relevant here, but I want to point out that just because you received it in plaintext doesn't mean they store it in plaintext.

So if you change it immediately to something more secure, and it might not be a security risk after all.

That isn't the point, if they can send it in plaintext then they have it in a recoverable form. They shouldn't be storing your password at all. They should be storing a hash of your password.

And on top of all that, sending it plaintext via email, itself a largely open format, means they've broadcast it to all kinds of other potentially bad actors.

Plus it indicates (to me) a questionable grasp of security, not a great sign for a VPN provider.

Its just wrong.

It could very well just mean that the email is sent before any hashing occurs (as part of the registration controller, in other words) - but yeah, you're right, considering that email's physical equivalent is a postcard, it shows a tremendous lack of respect for the user. Kiss of death for a supposedly privacy focused operation like a VPN provider.

Looks like you set the password originally, then they send THAT password plaintext.

It'd be acceptable if it was a random password generated for email-auth reasons. Not acceptable if you're setting the password.

Reply on news.ycombinator.com