476
Larion Studios forum stores your passwords in unhashed plaintext. Don't use a password there that you've used anywhere else.
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 28 Sep 2023
476 points (100.0% liked)
Games
38586 readers
1658 users here now
Welcome to the largest gaming community on Lemmy! Discussion for all kinds of games. Video games, tabletop games, card games etc.
Weekly Threads:
Rules:
-
Submissions have to be related to games
-
No bigotry or harassment, be civil
-
No excessive self-promotion
-
Stay on-topic; no memes, funny videos, giveaways, reposts, or low-effort posts
-
Mark Spoilers and NSFW
-
No linking to piracy
More information about the community rules can be found here and here.
founded 2 years ago
MODERATORS
While sending your password in plaintext over email is very much a bad idea and a very bad practice, it doesn't mean they store your password in their database as plaintext.
Encrypted passwords are still an unacceptable way to store passwords. They should be hashed.
(and salted before hashing.)
And marinated in butter milk.
Peppered if you're feeling extra
Just because they send out the password does not mean it's not hashed. They could send the email before hashing.
You're correct and after reading more of the thread I saw OP say this was sent immediately after registering. I don't have reason to believe it is stirred in plaintext unless they're storing s copy of every email they send.
Would you accept "in a way that can be reversed"?
Passwords shouldn't be stored at all though 🤷♂️
You mean plaintext passwords right? Ofcourse then need to store your (hashed)password!
The hash is not the password.
My bad! I just misunderstood >.<
If they stored the hashed password this thread wouldn't exist.
Point is, a hash isn't a password. giving the most you don't need tech knowledge analogy, it's like the passwords fingerprint.
The police station may keep your daughters fingerprint so that if they find a lost child they can recognize it is your daughter beyond any doubt. Your daughters fingerprints, is like a hash, your daughter is a password.
The police should not store your daughter... that's bad practice. The fingerprints are all they should store, and needless to say the fingerprints aren't your daughter, just as a hash isn't a password.