Hosting Service Storing Password in Plain Text

[burn]

I signed up for a service to host a site with a hosting service company that has a number of recommendations on this forum.

In the process, I signed up as a client on their website. I then received a confirmation email with my client area password in plain text. Not a temporary generated password but the one I entered at signup.

As far as I understand, this means that the password is stored in plain text and not encrypted on their server.

Being a hosting company, I am quite surprised by this oversight. I now doubt the rest of their security practices.

Is my assessment of the plain text storing of my password correct, and is it something I should be concerned about? I just want to check before I rant and cancel my account/ request a refund.

 

[Ipwn 4]

Whmcs sends it as ref and no it is not stored in plain text.

 

[Murmaider]

Just because you receive the password in an email does not mean it is stored in plain text. It is encrypted in the database.
WHMCS sends you the password as a reference before it encrypts it and stores it in SQL.

If you are worried you could also login to the control panel and change your password, this way no email is generated and the password is encrypted instantly.

 

[koffiejunkie]

WHMCS sends you the password as a reference before it encrypts it and stores it in SQL.

OP didn't mention WHMCS. He said he signed up on the company's website.

Also, passwords should be stored using a one-way hashing algorythm designed for passwords (like PBKDF2) - not in a decryptable format.

 

[koffiejunkie]

I signed up for a service to host a site with a hosting service company that has a number of recommendations on this forum.

Name and shame.

 

[Ipwn 4]

Name and shame.

That would be every hosting provider in the world that uses WHMCS or part thereof....

 

[burn]

It could well be WHMCS.

Why not encrypt it immediately though? Surely, the plain text password has to be stored somehow (even if for a short time) to be used as a reference in an email (or how does it get there?), and passing it through a bunch of mail servers could be avoided.

I feel passwords should never see the light of day. Is this unreasonable?

 

[icyrus]

It could well be WHMCS.

Why not encrypt it immediately though? Surely, the plain text password has to be stored somehow (even if for a short time) to be used as a reference in an email (or how does it get there?), and passing it through a bunch of mail servers could be avoided.

I feel passwords should never see the light of day. Is this unreasonable?

Sending the password over email is inherently insecure and they shouldn't be doing it. That doesn't mean they are storing it in clear text, they may have just kept it in memory long enough to generate the email.

 

[Murmaider]

It could well be WHMCS.

Why not encrypt it immediately though? Surely, the plain text password has to be stored somehow (even if for a short time) to be used as a reference in an email (or how does it get there?), and passing it through a bunch of mail servers could be avoided.

I feel passwords should never see the light of day. Is this unreasonable?

The password remains in memory for the 0.01 seconds it takes to send the mail before it's encrypted.
I completely agree with you regarding the password being sent in an email, because this can be intercepted, this has always been a discussion with WHMCS and it's million users. As mentioned there are 2 things which could give you peace of mind.

One is login and change your password (encrypted instantly - no email sent).
Two is enable 2-factor authentication, This will require you to enter a OTP on each login so no one can access your account.

 

[RNJudas]

Not that I dont get your point, but at this rate--no security measure offering any sort of authentication in any phase (2-facter/OTP) is safe. The idea that any form of communication can be intercepted is then the overall concern here. Your OTP gets sent from a provider through a network, as does 2-way. At which point do you perceive this as not possible to be intercepted?

Your best bet here then would be cryptography & anonymity making the association to any account details even harder to isolate, but even this has its limitations.

**However, that being said:

You shall not improve security if it means clients will just have to put in a little more effort
You shall not improve security if it creates more work for general staff
You shall not improve security if it generates an increase in the budget that can simply be overcome with a simple script.

All and all, Irony--God's sense of humor.

 

[greersome]

In the process, I signed up as a client on their website. I then received a confirmation email with my client area password in plain text. Not a temporary generated password but the one I entered at signup.
...
... is it something I should be concerned about? I just want to check before I rant and cancel my account/ request a refund.

Short answer: Yes, cancel your service. Go with someone else.

Longer answer: It doesn't matter if they say the text is stored for a millisecond and many times, they are full of compost. I encountered the same problem recently signing up for Web.com.

Although they've not replied that this is secure (I'm sure they will), they also show my password in plain text AFTER I logon to their site!

Any company who does this shouldn't be in business. If a computer can get your "encrypted" password, decrypt it and send it to you in an email, then any savvy hacker or unscrupulous employee of the company can use the same mechanism to do the same.

Name and shame as someone else has mentioned. There is no excuse for this, regardless of any fancy technology they purport to use.

 

[Ipwn 4]

Any company who does this shouldn't be in business. If a computer can get your "encrypted" password, decrypt it and send it to you in an email, then any savvy hacker or unscrupulous employee of the company can use the same mechanism to do the same.

What is logic?
Please explain to me how a computer will know your password is correct if it can't compare the text you entered to the encrypted version in the db?

Doesn't seem that you understand encryption all that well my man.

 

[Solitude]

What is logic?
Please explain to me how a computer will know your password is correct if it can't compare the text you entered to the encrypted version in the db?

Doesn't seem that you understand encryption all that well my man.

Nope, greersome is correct. The password should be hashed which is a one way encryption. So it can't be decrypted and sent to a user.

Hmmm let me google it for you...
https://crackstation.net/hashing-security.htm

So logically the system shouldn't just be able to send the original password back to a user after a long while since it should never actually be stored. The hash is stored, preferably salted and then if a password is requested the password should be reset and a new password entered.

 

[Murmaider]

Short answer: Yes, cancel your service. Go with someone else.

Longer answer: It doesn't matter if they say the text is stored for a millisecond and many times, they are full of compost. I encountered the same problem recently signing up for Web.com.

Although they've not replied that this is secure (I'm sure they will), they also show my password in plain text AFTER I logon to their site!

Any company who does this shouldn't be in business. If a computer can get your "encrypted" password, decrypt it and send it to you in an email, then any savvy hacker or unscrupulous employee of the company can use the same mechanism to do the same.

Name and shame as someone else has mentioned. There is no excuse for this, regardless of any fancy technology they purport to use.

Who is saying that the password is being decrypted and then sent to the customer?
You do understand that the unencrypted password when entered is first passed (in memory) on the server in order for it to be one way encrypted in the first place?

So logically the system shouldn't just be able to send the original password back to a user after a long while since it should never actually be stored. The hash is stored, preferably salted and then if a password is requested the password should be reset and a new password entered.

Unless it is sent to the user before it's hashed up and stored in the database.

I'm not sure where I see anyone saying that the password is being stored in plain-text or is being stored in a decrypt-able format?

It seems the concern is regarding the password in memory on the server, which is actually far less accessible than when you enter your password on a non-ssl site, like mybroadband and as FFF4Skin mentioned, even OTP type logins have a risk since the OTP can be intercepted.

 

[Solitude]

Who is saying that the password is being decrypted and then sent to the customer?
You do understand that the unencrypted password when entered is first passed (in memory) on the server in order for it to be one way encrypted in the first place?

Unless it is sent to the user before it's hashed up and stored in the database.

I'm not sure where I see anyone saying that the password is being stored in plain-text or is being stored in a decrypt-able format?

It seems the concern is regarding the password in memory on the server, which is actually far less accessible than when you enter your password on a non-ssl site, like mybroadband and as FFF4Skin mentioned, even OTP type logins have a risk since the OTP can be intercepted.

That's why I added the bit "after a long while". See Greesome mentioned:

Although they've not replied that this is secure (I'm sure they will), they also show my password in plain text AFTER I logon to their site!

Any company who does this shouldn't be in business. If a computer can get your "encrypted" password, decrypt it and send it to you in an email, then any savvy hacker or unscrupulous employee of the company can use the same mechanism to do the same.

Which pertained to his own experiences and not that of the OP. After which Ipwn4 replied with

Please explain to me how a computer will know your password is correct if it can't compare the text you entered to the encrypted version in the db?

And hence my reply about the hashing and it being a one way encryption. So to answer this question:

I'm not sure where I see anyone saying that the password is being stored in plain-text or is being stored in a decrypt-able format?

Is because of the people that I quoted earlier. Of course the password that is sent immediately comes from memory (or so one would assume) but I wasn't replying to any of those posts.