2019-05-17, 06:47 PM
(2019-04-30, 07:05 PM)michael@belgium Wrote:Quote:If any website emails your password back in plain text, then he is surely storing your password as such
Not really.?You can't know that. You could just hash a temporary plain password, save it in the database, and send the plain pass to the user
That's still a terrible red flag. Password hashing shouldn't be reversible. And there should be no plaintext passwords anywhere for absolutely no reason (other than in memory when a log-in or register is being executed, in which case it must be properly trashed inmediatly after the operaton is complete)