That doesn't really mean that they store it in plain text. They sent it to you after you finished creating your account, and it's likely that the password was just in plain text during the registration. The question still remains whether they store their outgoing emails (in which case yes, your password would still be stored in plain text on their end, not in the database though).

[–] [email protected] 107 points 1 year ago* (last edited 1 year ago) (8 children)

Your guess is confirmed here.

There are plans to update the forum, including for better security (the main issue with changing the forum software is concern over reliably migrating all of the existing content). After emailing (admittedly not current best practice), the passwords are hashed and only the hash is stored.

...and later...

The forum has been updated to https, and passwords are no longer being sent by email.

Which raises the question of how old OP's screen shot is.

Also, no, the password would not necessarily still be stored in plain text on their end. The cleartext password used in that email might be only in memory, and discarded after sending the message. Depends on how the UBB forum software implemented it and how Larian's mail servers are set up.

EDIT: I just verified that this behavior has resurfaced since it was originally fixed. OP would do well to responsibly report it, rather than stirring up drama over a web forum account.

[–] Cabrio 1 points 1 year ago

OP would do well to responsibly report it, rather than stirring up drama over a web forum account.

¿Porque no los dos?

Took them 23 years to fix it last time, seems public awareness would be important in the interim, no?

load more comments (7 replies)

load more comments (25 replies)