forums.gentoo.org password security

[NP-Hardass]

I just signed up for an account, and noticed that upon registration, my password was emailed in plaintext to me.
That's definitely a major no-no on it's own. But since your system was able to plaintext sent it to me in the first place, I'm going to assume that they are also stored in plaintext... That's pretty bad security wise. Can someone look into this and comment?

[jpc22]

Cannot confirm if they are stored in plain text, but i did not pay attention to that when i signed up.

Otherwise i think/hope the rest of gentoo services/features are safer.

Forum password safety is not that much dramatic compared to other stuff that could be compromised like mirrors, but it still needs to be adressed like you pointed out.

[Ant P.]

It's phpBB 2.0.23. The password is stored as an MD5 hash and only sent back as plaintext because you just submitted it in plaintext.

In short you have nothing to worry about, as long as the URL bar starts with "https:".

[NP-Hardass]

Thanks for the response

From what I've read online, the phpBB 2 systems use an unsalted hash. And we don't force the login to https, nor do we by default link to https from the gentoo.org website. So I think that alone is insufficient to a claim at mitigation.

[krinn]