I just signed up to your site, and you emailed me back my password in plain text. This means you are storing them as plain text and they are not hashed or hashed and salted. This is super insecure and makes you a massive target for hackers. :|
The fact that the password is sent as plaintext once upon registering does not mean by itself that they're stored that way. This forum platform is managed & hosted by Xobor so only they have DB access, thus I've no idea how they protect such info. Obviously I hope that they're hashed but don't know for sure. I'll try asking.
@ariyasu: Welcome to the Win-RAID Forum and thanks for your contribution.
AFAIK the only reason for sending the registration confirmation with nickname and password as plaintext is to avoid a failure of the first login done by the new Forum member. By the way - the password can be changed by the user at any time, that means directly after the first login.
Regards Dieter (alias Fernando)
My current System: MB: ASRock X570 Pro4, CPU: AMD Ryzen 5 3600, System Drive: 500 GB Samsung 980 Pro, Graphics: Sapphire Radeon RX570, OS: Win10 x64 Pro Donation Link: If you are satisfied with my Forum activities, you can send a donation to my personal PayPal account by clicking onto >this< link.
Print view
Tue May 28, 2019 7:17 pm
reply
Win-Raid Forum (Drivers - Firmware - Modding)
»
General & Forum related Topics
»
Forum-related Questions & Suggestions
»
Insecure Password System
