Gsyfuy

How to be diplomatic in refusing to write code that breaches the privacy of our users

Finding all intervals that match predicate in vector

Ways to speed up user implemented RK4

Coordinate position not precise

What's a natural way to say that someone works somewhere (for a job)?

Your magic is very sketchy

Opposite of a diet

Why did Kant, Hegel, and Adorno leave some words and phrases in the Greek alphabet?

What is the intuitive meaning of having a linear relationship between the logs of two variables?

Implement the Thanos sorting algorithm

Greatest common substring

when is out of tune ok?

Products and sum of cubes in Fibonacci

The plural of 'stomach"

Is it okay / does it make sense for another player to join a running game of Munchkin?

Is exact Kanji stroke length important?

Valid Badminton Score?

How will losing mobility of one hand affect my career as a programmer?

Can a monster with multiattack use this ability if they are missing a limb?

Why "be dealt cards" rather than "be dealing cards"?

The baby cries all morning

voltage of sounds of mp3files

Hostile work environment after whistle-blowing on coworker and our boss. What do I do?

What's the purpose of "true" in bash "if sudo true; then"

Is HostGator storing my password in plaintext?

Is it better to hash n*x times in sha1 or n times in sha512 on the client side?Definitely safest password storage scheme?Forgot Password? - sends email with plaintext passwordIs it ok for software to store passwords locally in plain-text?Finding Plaintext Password RepositoriesHow to avoid storing plaintext during CHAP authenticationReceived an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?Storing Password Hash plaintextThird party program is storing a password in a DSN. Is it a security threat?Methods for storing plaintext passwords on a client

2

I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.

I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:

I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?

passwords databases web-hosting

share|improve this question

edited 3 hours ago

Marquizzo

asked 3 hours ago

MarquizzoMarquizzo

1135

New contributor

Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.
  
  – schroeder♦
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.
  
  – Marquizzo
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Ok, that all good info to have.
  
  – schroeder♦
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.
  
  – Patrick Mevzek
  2 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.
  
  – Future Security
  2 hours ago
  

  
  
  
  

 | 
show 2 more comments

2

I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.

I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:

I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?

passwords databases web-hosting

share|improve this question

edited 3 hours ago

Marquizzo

asked 3 hours ago

MarquizzoMarquizzo

1135

New contributor

Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.
  
  – schroeder♦
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.
  
  – Marquizzo
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Ok, that all good info to have.
  
  – schroeder♦
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.
  
  – Patrick Mevzek
  2 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.
  
  – Future Security
  2 hours ago
  

  
  
  
  

 | 
show 2 more comments

I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.

I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:

I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?

passwords databases web-hosting

share|improve this question

edited 3 hours ago

Marquizzo

asked 3 hours ago

MarquizzoMarquizzo

1135

New contributor

Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

edited 3 hours ago

Marquizzo

asked 3 hours ago

MarquizzoMarquizzo

1135

New contributor

Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

edited 3 hours ago

Marquizzo

asked 3 hours ago

MarquizzoMarquizzo

1135

New contributor

Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 3 hours ago

MarquizzoMarquizzo

1135

New contributor

Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 3 hours ago

MarquizzoMarquizzo

1135

2 Answers
2

active

oldest

votes

6

Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).

Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.

Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.

share|improve this answer

answered 3 hours ago

CBHackingCBHacking

10.9k11627

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
  
  – Marquizzo
  1 hour ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
  
  – psosuna
  1 hour ago
  
  
  

  
  
  
  

add a comment | 

-2

We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.

share|improve this answer

edited 3 hours ago

schroeder♦

78k30173209

answered 3 hours ago

Jason MichaelsJason Michaels

11

New contributor

Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
  
  – Marquizzo
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
  
  – Jason Michaels
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
  
  – Jason Michaels
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
  
  – Peteris
  2 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
  
  – Jason Michaels
  2 hours ago
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206186%2fis-hostgator-storing-my-password-in-plaintext%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

6

Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).

Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.

Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.

share|improve this answer

answered 3 hours ago

CBHackingCBHacking

10.9k11627

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
  
  – Marquizzo
  1 hour ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
  
  – psosuna
  1 hour ago
  
  
  

  
  
  
  

add a comment | 

6

Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).

Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.

Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.

share|improve this answer

answered 3 hours ago

CBHackingCBHacking

10.9k11627

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
  
  – Marquizzo
  1 hour ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
  
  – psosuna
  1 hour ago
  
  
  

  
  
  
  

add a comment | 

Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).

Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.

Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.

share|improve this answer

answered 3 hours ago

CBHackingCBHacking

10.9k11627

share|improve this answer

answered 3 hours ago

CBHackingCBHacking

10.9k11627

answered 3 hours ago

CBHackingCBHacking

10.9k11627

answered 3 hours ago

CBHackingCBHacking

10.9k11627

-2

We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.

share|improve this answer

edited 3 hours ago

schroeder♦

78k30173209

answered 3 hours ago

Jason MichaelsJason Michaels

11

New contributor

Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
  
  – Marquizzo
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
  
  – Jason Michaels
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
  
  – Jason Michaels
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
  
  – Peteris
  2 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
  
  – Jason Michaels
  2 hours ago
  

  
  
  
  

add a comment | 

-2

We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.

share|improve this answer

edited 3 hours ago

schroeder♦

78k30173209

answered 3 hours ago

Jason MichaelsJason Michaels

11

New contributor

Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
  
  – Marquizzo
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
  
  – Jason Michaels
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
  
  – Jason Michaels
  3 hours ago
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
  
  – Peteris
  2 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
  
  – Jason Michaels
  2 hours ago
  

  
  
  
  

add a comment | 

We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.

share|improve this answer

edited 3 hours ago

schroeder♦

78k30173209

answered 3 hours ago

Jason MichaelsJason Michaels

11

New contributor

Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this answer

edited 3 hours ago

schroeder♦

78k30173209

answered 3 hours ago

Jason MichaelsJason Michaels

11

New contributor

Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

edited 3 hours ago

schroeder♦

78k30173209

edited 3 hours ago

schroeder♦

78k30173209

answered 3 hours ago

Jason MichaelsJason Michaels

11

New contributor

Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

answered 3 hours ago

Jason MichaelsJason Michaels

11