Gentoo Forums: On register, password is emailed in plaintext

throwaway12394 · n00b Joined: 02 Aug 2020 Posts: 3

I just registered this account for unrelated emails. It appears my password has been sent to me in plaintext. This is far from best practice. While fixing I'd also recommend double-checking that passwords are hashed+salted within the database appropriately.

NeddySeagoon · Posted: Sun Aug 02, 2020 8:51 am Post subject:

Moved from Networking & Security to Gentoo Forums Feedback.

Yes, passwords are hashed. I'm not sure about salted.

The forums uses phpBB 2.0.23-gentoo-p11, which is well past its use by date.
There is an upgrade to phpBB 3.x in the works, so any fixes to 2.0.23 are unlikely.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

fturco · Veteran Joined: 08 Dec 2010 Posts: 1181 Location: Italy

https://bugs.gentoo.org/431106

Ant P. · Watchman Joined: 18 Apr 2009 Posts: 6920

Passwords are stored MD5 hashed and thrown away after the email is sent.

You're right it's far from best practice, but that's why everyone uses a password manager with strong random per-site passwords nowadays, right? :)

Banana · Veteran Joined: 21 May 2004 Posts: 1416 Location: Germany

anything new about the forum upgrade?
_________________
My personal space
My delta-labs.org snippets do expire

PFL - Portage file list - find which package a file or command belongs to.

krinn · Watchman Joined: 02 May 2003 Posts: 7470