That doesn’t really mean that they store it in plain text. They sent it to you after you finished creating your account, and it’s likely that the password was just in plain text during the registration. The question still remains whether they store their outgoing emails (in which case yes, your password would still be stored in plain text on their end, not in the database though).
Honestly, why risk duplicate passwords even then? I have one strong password that I use for accessing my password manager, and let the password manager generate unique random passwords. Even if I had an easier password that I duplicated with some small changes, I’d still use a password manager to autofill it anyway. I use bitwarden personally, you can also self host it with vaultwarden but it seemed like more trouble than it was worth imo
This is a friendly reminder to everyone that password managers are not risk free either. LastPass was hacked last year, NortonLifeLock earlier this year.
Personally the risk of bitwarden is outweighed by its convenience (compared to self hosted/local only solutions) in my opinion, but I know that’ll change real quick if bitwarden ever has a breach. If it does I’m jumping ship to a self hosted or local only solution, but I’m hoping that doesn’t have to happen
Bitwarden is end to end encrypted. If the host gets hacked your passwords are still as safe as your master password is. Self hosting wouldn’t really be a huge help there. Possibly even detrimental depending on your level of competence at securing a public facing web host.
Yeah at this point it’s considered likely that LastPass vaults are being cracked, based on LP being the common link between various other accounts that are being breeched.
A small number of rounds of encryption being the default for users with old enough accounts is believed to be a significant part of the issue. It means even if their password was a good one, the vault can be brute forced comparatively quickly.
If their password was actually good (18+ random characters) it’s not feasible with current day technology to brute force, no matter how few PBKDF2 iterations were used.
Obviously it’s still a big issue because in many cases people don’t use strong enough passwords (and apparently LastPass stored some of the information in plaintext) but a strong password is still good protection provided the encryption algorithm doesn’t have any known exploitable weaknesses.
your passwords are still as safe as your master password is
They’re as safe as your master password is…and as the encryption is. LastPass famously got hacked recently, and in the aftermath of that many users noticed that their vault was encrypted using very small numbers of rounds of PBKDF2. The recommended number of rounds had increased, but LastPass left the number actually used too low for some users, rather than automatically increasing it. Users of Bitwarden and any other password vault should ensure that their vault is using the strongest encryption available.
Self hosting wouldn’t really be a huge help there
Well, self-hosting makes you a smaller target. The most determined attackers are likely going to go after the biggest target, which is going to be a centralised service with thousands of users’ vaults. If you host it yourself they probably won’t even know it exists, so unless there’s reason for someone to be specifically targeting you (e.g. you’re a public figure), or you get hacked by some broad untargeted attack, you might be better off self-hosted from a purely security standpoint.
(That said, I still use centrally-hosted Bitwarden. The convenience is worth it to me.)
You’re underestimating the attack surface of a self hosted set up. You don’t need to be specifically targeted if, for instance, someone hacks the Bitwarden docker image you’re using, or slips a malicious link into a tutorial you’re reading. It’s not a set it and forget it solution either, you’re responsible for updating it, and the host OS. Like I said, depending on your competency, it’s not inherently more secure.
This is why I don’t use a common centralized password manager, just like I don’t use any of the most popular remote desktop solutions like TeamViewer for unattended access.
I run a consumer copy of Pleasant Password Manager out of AWS and use NoMachine for unattended access to any machines where I need it.
Security through obscurity is tried and true. Put as little of your security attack surface in the hands of others as is reasonable.
I actually think this is the case. I could be completely wrong but I swear I saw the same question like 6 years ago in another forum software that looks exactly like this one lol. And people compalined about it storing plain text, but the response when asking the forum people was that it was only during that password creation, it’s not actually stored.
I don’t know if it’s crazy for me to think it’s the same forum from that many years ago, still doing the same thing and getting the same question.
There are plans to update the forum, including for better security (the main issue with changing the forum software is concern over reliably migrating all of the existing content). After emailing (admittedly not current best practice), the passwords are hashed and only the hash is stored.
…and later…
The forum has been updated to https, and passwords are no longer being sent by email.
Which raises the question of how old OP’s screen shot is.
Also, no, the password would not necessarily still be stored in plain text on their end. The cleartext password used in that email might be only in memory, and discarded after sending the message. Depends on how the UBB forum software implemented it and how Larian’s mail servers are set up.
EDIT: I just verified that this behavior has resurfaced since it was originally fixed. OP would do well to responsibly report it, rather than stirring up drama over a web forum account.
It is still a bad idea to send the password in plaintext via email. You never know when Bard will peek a look and then share your password along users as a demo account to try that forum.
You should always change your password from the system generated one to prevent that from happening. The app that you signed up for should enforce that by making you change your password when you log in.
There’s a lot of reasons why emailing passwords is not the best practice… But AI bots stealing your password to give people free demos is a wild paranoid fever dream.
It is meant to be as a joke, of course the AI is not that dumb enough to give it away as free demo. Why am I being downvoted? Why don’t people understand jokes these days? Do I always have to include /s when making a sarcastic joke even though it is so obvious?
Bomb Rush rush Cyberfunk, got almost all of the tags, now I’m trying for the ~15 mill score achievements, which I somehow always fail at like 13 mill. pain
My only suggestion would be to take your time and take breaks between them to play other games. They’re great, but they’re all very similar. An easy recipe for burnout.
Second this. They have so many activities, but kinda repetitive if play each entry back to back. With a somewhat Grundy nature, it burnt out fast, if not rush.
Just starting to properly explore the depths in Zelda TOTK after already spending about 65 hours so far. Have upgraded armour enough at this point that battles are feeling pretty easy with bosses not even doing much damage (eg the
!shadow ganondorf !< fight was only taking quarter hearts of damage)
Still feeling like there is a lot of life and exploring to do before I try finish the main quest.
I’ve been hooked on “God of weapons”, recently. Pretty good rng auto combat meets slim downed “Hades”, worth a look and the dev seems to be looking for feedback.
Just switched from starfield back to cyberpunk for the 2.0 update. It’s consuming my life again. When I finish the dlc I’ll switch back to starfield and let that consume my life.
Same here dude haha. Starfield was fun, but man has Night City just sucked me back in. I love Cyberpunk so much. I am looking forward to going back to Starfield at some point, it is a great chill out and vibe kinda game.
Work has been busy, so i played Call of Duty DMZ after work for some short relaxation. Been doing for months, kinda getting good at it. 6 days ago i was shadowbanned for killing to many players who probably reported me. Now i’m getting matched in high ping >200ms lobby. I swear I’ve never use hack or hardware cheating things. So i uninstall and start getting into Titanfall2
Baldurs Gate 3 was released on Friday on Mac. I played the preview and some hours on parallels and am glad now I can play natively now.
My problem is, this world is to big. I like role playing my character, even if it is not optimal. I read every dialogue and think: “what would Hsslek (my Githyanki Dragonborn Wizard) do?”
The great thing is, after around 50 hours I now have a picture of my character. A curious mind, not always fitting into Githyanki society, but counting on the Githyanki Warrior who shares his fate and is becoming his lover.
lemmy.world
Gorące