This thread is frustrating. Everyone seems more interested in nitpicking the specifics of what OP is saying and are ignoring that a forum sends you your password (not an automatically generated one) in an email on registration.
This thread is frustrating. Everyone seems more interested in nitpicking the specifics of what OP is saying and are ignoring that a forum sends you your password (not an automatically generated one) in an email on registration.
Yep. That’s how security works. You have to nitpick the specifics.
The reality is nobody has invented a perfectly secure authentication system that is easy to use (for example, allows easy recovery when people forget their password which for any large service will be tens of millions of times per day).
Attempts have been made - passkeys being the latest one - but they’re not even remotely easy to use as soon as you step slightly out of the most common path (such as using the web browser that is provided by the company you’re logged in with… try to use Chrome with an Apple passkey, or Safari with a Google passkey, and you’re going to stumble into usability issues).
Passwords are not considered secure wether they’re sent in a plaintext email or not. They can be secure, if used properly, but 99% of users don’t follow best practices. As a result almost every web service in the world is insecure and it’s the nitpicky details that matter.
Sending a secret to an email address is a standard step during registration for almost any service.
But the thing is that you should never have access to the plaintext password and thus you should never be able to receive it in an email. You should store the salted hash of the password instead of the password itself.
These kind of forums don’t store the plaintext password, they send an email while in memory, and hash them afterwards. Still bad security, but it’s not storing it in plaintext.
It’s storing it in plain text in at least one third party’s database. Indeed, it’s not stored in plain text locally, it’s doing something much worse
But you are supposed to change that generated password as soon as you use it to login. Now I have no idea about these forums, but you’d expect the software to enforce that need to change
It’s still stupid because people reuse password. They shouldn’t, but they do. If it’s one time login, make it a token. There’s zero reason to ever email a password, period
But your password should never reach the server. It should be hashed already at the client and then salted at the server with a random hash. Then you store the salted hash
When I say “nitpicking the specifics” I mean OP is saying things like the password should never be unencrypted in memory in the same comment as mentioning things like the password in plaintext in the email and folks are more interested in browbeating over the first thing rather than acknowledging the second as a problem. I see this behavior far too often in tech spaces online. People are often more concerned with being pedantic and technically correct than anything else.
The person you’re responding to is doing the exact same thing you are complaining about, and finished their comment with something obviously wrong. They are not arguing in good faith