Gentoo Forums: On register, password is emailed in plaintext

Message

throwaway12394 · Post by **throwaway12394** » Sun Aug 02, 2020 4:31 am

I just registered this account for unrelated emails. It appears my password has been sent to me in plaintext. This is far from best practice. While fixing I'd also recommend double-checking that passwords are hashed+salted within the database appropriately.

Post by **NeddySeagoon** » Sun Aug 02, 2020 8:51 am

Moved from Networking & Security to Gentoo Forums Feedback.

Yes, passwords are hashed. I'm not sure about salted.

The forums uses phpBB 2.0.23-gentoo-p11, which is well past its use by date.
There is an upgrade to phpBB 3.x in the works, so any fixes to 2.0.23 are unlikely.

fturco · Post by **fturco** » Sun Aug 02, 2020 11:02 am

https://bugs.gentoo.org/431106

Ant P. · Post by **Ant P.** » Mon Aug 03, 2020 4:40 am

Passwords are stored MD5 hashed and thrown away after the email is sent.

You're right it's far from best practice, but that's why everyone uses a password manager with strong random per-site passwords nowadays, right? :)

Post by **Banana** » Mon Aug 03, 2020 5:46 am

anything new about the forum upgrade?

krinn · Post by **krinn** » Mon Aug 03, 2020 11:46 am

Banana wrote:anything new about the forum upgrade?

a question for viewtopic.php?p=8427828