|
I haven't been on this site in a while, so I forgot my password. I clicked the link, and The Code Project sent me my password in clear text in an email.
I would think that a site that specializes in advice for coders would know better than to store passwords using reversible encryption or send them in clear text.
It's a sad state of affairs, but many people use the same password across multiple sites. By keeping users passwords in the clear, your site is a tempting target for hackers, and if they do compromise your database, then thousands of passwords will be exposed.
In this day and age, the state of your security is inexcusable. Please fix this immediately. Your reputation is already tarnished - no serious software engineer would allow this glaring flaw to make it into production. Please take action before more than your reputation is at stake.
|
|
|
|
|
Are you sure it was your previous password (which you can't remember), and not a new, randomly generated password? 
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
The password you received is a temporary one. Only valid for 1hour.
When you log in with that temporary password it becomes your permanent password (until you change it again).
This is very clearly stated on the screen after submitting the 'forgot my password'.
Please note: The temporary password that was sent will expire in 1hr. Your existing password (should you remember it) will remain valid until you update it. If you log in with your temporary password, your existing password will be updated to be the temporary password you entered.
So no your password is not saved in clear text.
Tom
|
|
|
|
|
You needed to pepper your post with statements like
"Being a coder you should know this.." and "It's a sad state of affairs.." and "Your reputation was low anyway..." and so on
|
|
|
|
|
I, too, would like Code Project to send the encrypted password instead of the one in clear text in the email.
modified 25-Aug-15 8:17am.
|
|
|
|
|
Rage wrote: send the encrypted password instead of the one in clear text in the email
How would that work? 
If they sent you the password hash, you'd have no way to determine what the password was, and no way to log in.
If they changed everything to used reversible encryption - which would be a terrible idea! - and sent you the encrypted password, they'd also have to send you the encryption key so that you could decrypt the password. Making the encryption key public would defeat the whole purpose of encrypting the passwords.
Sending a temporary, randomly-generated, time-limited password to your registered email address is the only sensible way to handle a forgotten password.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Nevermind, I definitely need to use the joke icon when it is meant to. This was of course irony10. 
|
|
|
|
|
bgard69772 wrote: I would think that a site that specializes in advice for coders would know better than to store passwords using reversible encryption or send them in clear text.
So would we. So we don't.
As explained, the password sent to you is a random, temp password with a limited time span. Your password is not saved by our system, only a salted hash with many iterations.
cheers
Chris Maunder
|
|
|
|
|
Christ! are we having a bad day? Really though you should think a bit more before making such ignorant remarks. The last three sections were completely unnecessary.
"the debugger doesn't tell me anything because this code compiles just fine" - random QA comment
"Facebook is where you tell lies to your friends. Twitter is where you tell the truth to strangers." - chriselst
"I don't drink any more... then again, I don't drink any less." - Mike Mullikins uncle
|
|
|
|
|
Message Removed
modified 24-Aug-15 6:00am.
|
|
|
|
|
Message Removed
modified 24-Aug-15 6:00am.
|
|
|
|
|
Message Removed
modified 24-Aug-15 6:00am.
|
|
|
|
|
Can you tell me why, the CodeProject dailybuild newsletter doesn't arrive to my e-mail box since August, 21, 2015?
Thanks. 
|
|
|
|
|
Did you check in your settings if it is due ?
|
|
|
|
|
Yes, surely it's due. Since yesterday I do receive newsletters. Thanks, the question is closed.
|
|
|
|
|
I was going to delete a draft article of mine, when I found that I am welcome there, too. 
Is it really necessary to welcome on that page[^] also?
The sh*t I complain about
It's like there ain't a cloud in the sky and it's raining out - Eminem
~! Firewall !~
|
|
|
|
|
A site based in Canada run by an Australian.
What can I say: we're friendly!
cheers
Chris Maunder
|
|
|
|
|
|
What do you get when you cross a joke with a rhetorical question?
The metaphorical solid rear-end expulsions have impacted the metaphorical motorized bladed rotating air movement mechanism.
Do questions with multiple question marks annoy you???
|
|
|
|
|
The ability to filter the questions under "Quick answers" is useful - except that it won't remember my filter choices between logged-in sessions, so I have to keep on re-applying them. It would be great if this could be addressed.... (unless I'm being particularly dumb this morning, in which case it would be great if you would be polite about it!  )
|
|
|
|
|
Because this: Usercontrol in Windows[^] is rather over the top.
"GimmeCode"
"IamLazy"
"DoMyWork"
"NoAttempt"
Sorry, but that's not appropriate, is it?
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
They are gone.
cheers
Chris Maunder
|
|
|
|
|
OriginalGriff wrote: "GimmeCode"
"IamLazy"
"DoMyWork"
"NoAttempt"
Too bad, they fit common situations.
Patrice
“Everything should be made as simple as possible, but no simpler.” Albert Einstein
|
|
|
|
|
Maybe, maybe not - but as Chris says "Insults, slap-downs and sarcasm aren't welcome. Let's work to help developers, not make them feel stupid.."
And tags like that don't help anyone - they are only used to make the OP feel stupid.
Tags are there to organise questions: so I can see it's "Oracle", and "PHP" - subjects I know nothing about - and not even look at them. Nobody sorts questions to find just the "IAmLazy" ones...particularly as do they get slapped on questions that the slapper just doesn't understand.
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
Ok, translation error
I would like these in question report, it would simplify choice.
Patrice
“Everything should be made as simple as possible, but no simpler.” Albert Einstein
|
|
|
|
|
Plus it is also funny that most of us have not contributed towards questions under category of "PHP" or "MySQL" -- I also didn't learn them -- but we are all found contributing and actively contributing towards questions categorized under "OffTopic" or "NotAQuestion".
I remember, 2 months ago I requested to remove "NotAQuestion" and other similar tags, well, he did and seems like the Tag cloud is cleaner now.
The sh*t I complain about
It's like there ain't a cloud in the sky and it's raining out - Eminem
~! Firewall !~
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
