Hacker News Reader

Comment by exikyut | Hacker News Reader

ARG. The sqlite mailing list manager sent me my plaintext password back in its "welcome" email.

D':

Mailing lists traditionally rely minimally on passwords. The "password" field at http://mailinglists.sqlite.org/cgi-bin/mailman/listinfo/sqli... has this copy:

"You may enter a privacy password below. This provides only mild security, but should prevent others from messing with your subscription. Do not use a valuable password as it will occasionally be emailed back to you in cleartext."

This is arguably better security because you can leave the password field blank, and a random one will be generated for you. That protects non-tech people from accidentally using a valuable password for something that is not actually security-sensitive.

Clearly not everyone reads the small print and even if they did that doesn't really excuse it in today's internet.

Hashing passwords is not hard.

Hashing password has nothing to do with sending email in plaintext.

You can hash password and also email password in clear text at sign up, when you still have access to the password.

And it doesn't even make sense to send hash of the password back in email.

I wasn't talking about sending emails.

But... the conversation was about sending the password in emails.

Read the comment I replied to. It explains that the passwords are not hashed at all. They are not sent in an email and then hashed.

I was talking about the practice quoted in that comment of not hashing passwords.

Edit: To be clear it doesn't say it explicitly, but it says that the cleartext password is sent periodically and the only way to do that is to not hash it.

That is just terrible policy. Password reuse is probably the biggest security problem there is, and until we can convince every human on the planet to use a password manager, every person that has to store a password needs to do so in a secure fashion. Saying "don't use a high-value password" is terrible practice.

If it makes you feel any better, the Fossil project (which is by the same developers, and is used for SQLite version control) recently moved off their mailing list and onto a new web forum/email notifications system built into Fossil, which has better security (better than this, certainly). SQLite will eventually move to the same system.

That doesn't necessarily mean that it stores the password in plaintext. It can mail you the plaintext password based on your own input upon sign-up before storing a salted hash in the database.

You should consider submitting this to http://plaintextoffenders.com/

Along with every mailman setup ever.

If you're not using a default-generated password in your mailman subscription you're doing it wrong.

(mailman should really just get rid of passwords altogether for non-mod/admin users.)

Reply on news.ycombinator.com