[6pack] vtr

[Alan Atkinson]

Leaving aside the security implications of email, this most likely means that
they are storing your password information as plaintext.

Which means that if anyone cracks their CMS everyone's password is open.

You all use disposable passwords for forums, right?



Most hashing algorithms (like MD5) are one way. Sorta pointless otherwise...


An example of this is the 6-Pack site (which I'm reasonable familiar with).

It uses a salted MD5 algorithm for password encryption.



The effect of this is that even the mods (and for that matter the webmaster)
can't see your password, let alone anyone who hacked the site.

All they can do it reset it (hopefully at your behest).



I hope I'm wrong about the plaintext thing - but then a two-way hashing
algorithm would be just as useless - and there's no other way I know of to
save passwords. Your best bet is to change your password to something
disposable (ie not the same as or close to any other one). But that's good
advice for ANY forum, list or group.






> From: sumton at sbcglobal.net
> To: triumphs at autox.team.net; 6pack at autox.team.net;
RedRiverTriumph at yahoogroups.com; membership at vtr.org
> Date: Mon, 1 Mar 2010 08:08:43 -0600
> Subject: [6pack] vtr
>
> I just received an email from the Vintage Triumph Register. every email
they
> send out has your username and password in clear text.
>
> help me out people - this is the most egregious security practice I have
ever
> seen. please send them an email and tell them to stop this practice!!!!!
> tell them you will not renew until they cease this incredibly amateurish
> habit.
>
> their email is membership at vtr.org
> _______________________________________________
>
> 6pack at autox.team.net
> Donate: http://www.team.net/donate.html
> Archive: http://www.team.net/archive
> Forums: http://www.team.net/forums
> Unsubscribe/Manage:
http://autox.team.net/mailman/options/6pack/alanatkinson@hotmail.com
>

_________________________________________________________________
Your E-mail and More On-the-Go. Get Windows Live Hotmail Free.
http://clk.atdmt.com/GBL/go/201469229/direct/01/