WARNING: These guys use plaintext passwords!!
Edit: I received the login info email after I clicked the activation link in a previous email, this means the password must have been stored in a database until I clicked the activation link.
It's not difficult to send a confirmation email that contains your password without having to store your password in plaintext anywhere.
Now, I don't know whether they store passwords in plaintext, but it's unfair to make such accusations based on the content of a registration confirmation email.
Edit: I received the login info email after I clicked the activation link in a previous email, this means the password must have been stored in a database until I clicked the activation link.
Again, there could be a less-than-ideal explanation for this, so we don't know 100% (I was hoping to see a "forgot password" link somewhere to test this with), but this does raise suspicions.
Email should always be treated as an insecure channel, so sending passwords over it is just bad security practice.
The system should only hang onto the password for as long as it takes to hash it.
If they're sending passwords in plaintext they're incompetent and not to be trusted, especially for this kind of service. Ouch.
For one, I do. There's a world of difference between handing a http post and storing passwords in the clear in the db.
If they're sending passwords in plaintext they're incompetent and not to be trusted, especially for this kind of service. Ouch.
I pretty much agree, but stand by my point that sending a password in a confirmation email is the lesser of the two evils.
Lets take it a step further... If this is insecure, how much trust can you put that your data is secure? The goal of good online backups is that the only way to actually read data from the backup is to have the user's password. They clearly don't have that as everything is reversible.
Dropbox used to claim to be like that, not anymore. Which is why I don't trust dropbox with private data. Instead I store it using AeroFS with local replication.
It is warning sign though, agreed.
Sorry, should of added that previously.
That's not a good sign. The best case scenario I can think of is that the email body is generated at registration and sent out once the activation link is clicked. After this the template is deleted. But it'd be far easier just to store your password in plaintext and go from there.
Like you, I'm suspicious.