Would you trust a site that did this?

SexyGreyFox

SexyGreyFox

SexyGreyFox

Man of Honour
Joined
29 Mar 2003
Posts
57,679
Location
Stoke on Trent
Like a lot of people I register on websites or other Forums (yes there are others) but sometimes I forget my login details so send for a recovery password.

A particular site called Audiospares (I didn't need to blank their name out) has sent me full login details back :eek:
I've sent for 100s of password recoveries but never have I seen my full details sent back.

passwordrecovery.jpg
 
Thanks for the login :D.

It's poor practise sending any account info to an email address in my opinion. The very most should be a username if forgotten.
 
Plenty of places send them in the original registration email, not great but I don't see the difference.
 
Certainly not with any payment information. If that side is handled separately then fair enough, otherwise it would only be paypal.

Its a good illustration of why you should always have a different password for every site.
 
Mynight said:
Thanks for the login :D.

It's poor practise sending any account info to an email address in my opinion. The very most should be a username if forgotten.
Click to expand...

The main problem is not that they are sending out the info by email, the problem is that they are obviously storing passwords unencrypted!
 
touch said:
The main problem is not that they are sending out the info by email, the problem is that they are obviously storing passwords unencrypted!
Click to expand...

Figured that went without saying sorry.

Assuming it was a password he's used before rather than a randomly generated one.

Damn he uses a different password for OCUK :D.
 
sexygreyfox is NOT your forum password here :)

And no, the company should never be able to see your passwords especially when it is a store that has access to payment details etc. It shoudl always be encrypted.

For example ocuk forums, the admins cannot see any user passwords - that is how it should be.
 
Not at all as that is a basic level of security I expect. It would make me consider how they stored other details too.

In the past I used to register for a website, then immediately request my password to see how they stored it, and this would help me decide on what type of password I would use, and what information I would store on their servers.
 
really bugs me when sites either do this, or send you a registration confirmation with the password in plain text - insanely bad practice - i'd be very tempted to complain to them and possibly trustwave / trustedshops that supposedly have certified them
 
I dislike it when I register somewhere and it tells me the password in confirmation email, doesn't seem very secure.
 
You must log in or register to reply here.
Back
Top Bottom