clear text password on registration to the forums

[Ana-Q]

Hi

I registered to the forum and received an email for confirmation. Besides the link that I have to click for the confirmation, I was amazed to see in the email my username and the password. I had to change the password immediately
Please check this issue. I will be grateful to know if this bug is corrected.

[szatox]

It's a known issue, it won't be corrected in foreseeable future.
BTW, anyone with access to your mailbox can reset your password, so changing it immediately doesn't make a huge difference. It is admittedly a bad design, yet it doesn't seem like anyone had a much better idea so far, so we kinda live with it - and it's not limited to FGO.

[Hu]

Searching the first two pages of the feedback forum, I found the following threads discussing this:

• Are passwords stored in plain text??
• Gentoo Forums: On register, password is emailed in plaintext
• New forum account creation
• Why storing user forum password as plain text?

[fedeliallalinea]

Moved from Networking & Security to Gentoo Forums Feedback.

[pjp]

I had to change the password immediately

That is the general recommendation.

As the upgrade is delayed without a set time, I wonder if some text could be changed during the signup process. This would inform users about the issue, which would hopefully be less alarming. Users would also be able to use a throwaway password rather than one they would prefer to keep.

[Chiitoo]

I had to change the password immediately

That is the general recommendation.

As the upgrade is delayed without a set time, I wonder if some text could be changed during the signup process. This would inform users about the issue, which would hopefully be less alarming. Users would also be able to use a throwaway password rather than one they would prefer to keep.

That just might be a change we might dare to make... yeah.

[NeddySeagoon]

Chiitoo,

In all the languages the forum supports?

[pjp]

Any that could be added would be an improvement.

[Chiitoo]

Chiitoo,

In all the languages the forum supports?

We can at least try that... too. :]

[sMueggli]

Chiitoo,

In all the languages the forum supports?

If the message templates are open source, why not?

[Hu]

I suspect Neddy's concern was whether the author of such a change could get reasonable wording for all the target languages. This may or may not be something that machine translators can convey adequately.

On the other hand, even if only the English template were amended, that would be an improvement over the current situation. Updating all the non-English templates would be nice, but helping some users is better than helping no one.

[Chiitoo]

Regardless of languages, and even though the sources are available, we don't currently have any way to test any changes we make (aside from a local instance of course), update the running version, or even make any changes to the live, running version.

That is 'we' as in the forums project members.

Only the Gentoo infra members (probably only some of them) can make any changes at this time.

See also:

https://bugs.gentoo.org/431106

[Hund]

This seems a small issue considering the fact that phpBB2 was abandoned 16 years ago. Who knows what security issues this forum comes with. :)