this post was submitted on 28 Sep 2023
323 points (75.7% liked)

Games

32950 readers
1126 users here now

Welcome to the largest gaming community on Lemmy! Discussion for all kinds of games. Video games, tabletop games, card games etc.

Weekly Threads:

What Are You Playing?

The Weekly Discussion Topic

Rules:

  1. Submissions have to be related to games

  2. No bigotry or harassment, be civil

  3. No excessive self-promotion

  4. Stay on-topic; no memes, funny videos, giveaways, reposts, or low-effort posts

  5. Mark Spoilers and NSFW

  6. No linking to piracy

More information about the community rules can be found here.

founded 2 years ago
MODERATORS
 

Larion Studios forum stores your passwords in unhashed plaintext. Don't use a password there that you've used anywhere else.

you are viewing a single comment's thread
view the rest of the comments
[–] inclementimmigrant 36 points 1 year ago* (last edited 1 year ago) (3 children)

While sending your password in plaintext over email is very much a bad idea and a very bad practice, it doesn't mean they store your password in their database as plaintext.

[–] [email protected] 31 points 1 year ago (3 children)

Encrypted passwords are still an unacceptable way to store passwords. They should be hashed.

[–] Cloodge 15 points 1 year ago (1 children)
[–] Dicska 11 points 1 year ago (1 children)

And marinated in butter milk.

[–] Cloodge 2 points 1 year ago

Peppered if you're feeling extra

[–] [email protected] 8 points 1 year ago (1 children)

Just because they send out the password does not mean it's not hashed. They could send the email before hashing.

[–] [email protected] 5 points 1 year ago

You're correct and after reading more of the thread I saw OP say this was sent immediately after registering. I don't have reason to believe it is stirred in plaintext unless they're storing s copy of every email they send.

[–] jeeva 14 points 1 year ago (1 children)

Would you accept "in a way that can be reversed"?

[–] [email protected] 2 points 1 year ago (1 children)

It's possible that this email is a result of forum user creation, so during that submission the plaintext password was available to send to the user. Then it would be hashed and stored.

[–] Serinus 1 points 1 year ago (1 children)

I don't know why you'd give them any benefit of the doubt. They should have already killed that with this terrible security practice.

But yeah, sure, maybe this one giant, extremely visible lapse in security is the only one they have.

[–] [email protected] 0 points 1 year ago (1 children)

I'm just explaining how user authentication works for most web applications. The server will process your plaintext password when your account is created. It should then store that as a hashed string, but it can ALSO send out an email with that plaintext password to the user describing their account creation. This post does not identify that passwords are stored in plaintext, it just identifies that they email plaintext passwords which is poor security practice.

[–] Serinus 1 points 1 year ago

This particular poor security practice is very much like a roach. If you see one you have a bigger problem.

See, I can also repeat myself as though you didn't understand the first time.

[–] [email protected] -1 points 1 year ago (1 children)

Passwords shouldn't be stored at all though 🤷‍♂️

[–] Vlixz 12 points 1 year ago (3 children)

You mean plaintext passwords right? Ofcourse then need to store your (hashed)password!

[–] [email protected] 10 points 1 year ago (1 children)

The hash is not the password.

[–] Vlixz 4 points 1 year ago* (last edited 1 year ago)

My bad! I just misunderstood >⁠.⁠<

[–] [email protected] 3 points 1 year ago

If they stored the hashed password this thread wouldn't exist.

[–] TheFogan 2 points 1 year ago

Point is, a hash isn't a password. giving the most you don't need tech knowledge analogy, it's like the passwords fingerprint.

The police station may keep your daughters fingerprint so that if they find a lost child they can recognize it is your daughter beyond any doubt. Your daughters fingerprints, is like a hash, your daughter is a password.

The police should not store your daughter... that's bad practice. The fingerprints are all they should store, and needless to say the fingerprints aren't your daughter, just as a hash isn't a password.