Welcome to the Piano World Piano Forums
Over 2 million posts about pianos, digital pianos, and all types of keyboard instruments
Join the World's Largest Community of Piano Lovers (it's free)
It's Fun to Play the Piano ... Please Pass It On!

Gifts and supplies for the musician

SEARCH
the Forums & Piano World

Trying Something New with Search
(ad) Pianoteq
(ad) Pearl River
Pearl River Pianos
(ad) P B Guide
Acoustic & Digital Piano Guide
(ad) Lindeblad Piano
Lindeblad Piano Restoration
Who's Online
76 registered (AndrewJCW, a-z0-9, augustm, ando, 17 invisible), 927 Guests and 15 Spiders online.
Key: Admin, Global Mod, Mod
(ad) Estonia Piano
Estonia Pianos
Quick Links to Useful Piano & Music Resources
Our Classified Ads
Find Piano Professionals-

*Piano Dealers - Piano Stores
*Piano Tuners
*Piano Teachers
*Piano Movers
*Piano Restorations
*Piano Manufacturers
*Organs

Quick Links:
*Advertise On Piano World
*Free Piano Newsletter
*Online Piano Recitals
*Piano Recitals Index
*Piano & Music Accessories
*Live Piano Venues
*Music School Listings
* Buying a Piano
*Buying A Acoustic Piano
*Buying a Digital Piano
*Pianos for Sale
*Sell Your Piano
*How Old is My Piano?
*Piano Books
*Piano Art, Pictures, & Posters
*Directory/Site Map
*Contest
*Links
*Virtual Piano
*Music Word Search
*Piano Screen Saver
*Piano Videos
*Virtual Piano Chords
Sheet Music
(PW is an affiliate)
Sheet Music Plus Featured Sale
Topic Options
#2036544 - 02/20/13 05:09 PM How about you don't send my password in a plain text email?
DavidCa Offline
Junior Member

Registered: 02/19/13
Posts: 1
When I registered here, I immediately got an email saying welcome to the forum, your username is <blah> and your password is <blah>.

This is bad because anyone can see those emails. It compromises security of this site majorly. It also compromises the security of other sites if that user has used the same password elsewhere.

Please change this.

Top
Piano & Music Accessories
#2191195 - 12/02/13 12:55 AM Re: How about you don't send my password in a plain text email? [Re: DavidCa]
lolatu Offline
500 Post Club Member

Registered: 11/01/13
Posts: 777
Loc: UK
Agree - I was pretty shocked to receive this in plain text too. I've never seen any other site send a password like this, with the exception of randomly generated single-use passwords that must be changed immediately.

Now anyone who can read my gmail (Google, NSA, GCHQ etc) can also see my username and password for this site, which in itself doesn't matter that much, but what if I used something similar for my bank account or who-knows-where else?

It may also be an indication of deeper security problems you have here, since it suggests you're actually storing passwords on your server. You should NEVER store passwords - this is a schoolboy error - only a salted hash. Please tell me this isn't so... if it is, you have a huge security liability on your hands, and getting hacked or otherwise compromised would be disastrous for you and your users.
_________________________
Kawai CA95 / Steinberg UR22 / Sony MDR-7506 / Pianoteq Stage / Galaxy Vintage D
In the loft: Roland FP3 / Tannoy Reveal Active / K&M 18810

Top
#2192848 - 12/05/13 09:06 AM Re: How about you don't send my password in a plain text email? [Re: DavidCa]
UKIkarus Offline
Full Member

Registered: 03/05/13
Posts: 357
Loc: England, South East
I'm pretty sure they would be storing salted hashes and the password being sent to the email is simply a copy of the value from the moment the form is submitted for registration as opposed to what is stored in the database.

They are however running a rather outdated version of the forum package which should ideally be updated, that said however I am fully aware of how difficult that can prove to be given that most end up changing the structure of templates/plugins so many of the originals no longer work/display correctly on the newer versions without some editing (in some cases A LOT of editing)

Perhaps this is why they have decided to stick with what they have for now?
_________________________
Yamaha MOX8 Synthesizer


Top
#2193471 - 12/06/13 12:06 PM Re: How about you don't send my password in a plain text email? [Re: DavidCa]
UKIkarus Offline
Full Member

Registered: 03/05/13
Posts: 357
Loc: England, South East
Scratch that, the version is 7.5.7 which is fairly recent ...
_________________________
Yamaha MOX8 Synthesizer


Top

(ad) Teaching Music To Children
Teaching Music to Children
(ad) Yamaha Stage Pianos
Yamaha CP4 & CP40 Stage Pianos
(ads) PD - WNG - MH
Mason & Hamlin Piano Factory Tours
Shop our Store for Music Lovers!
PianoSupplies.com is Piano World's Online Store
Please visit our store today.
Composer Statuettes
(ad 125) Sweetwater - Digital Keyboards & Other Gear
Digital Pianos at Sweetwater
(125ad) Dampp Chaser
Dampp Chaser Piano Life Saver
New Topics - Multiple Forums
Original Wedgewood Blue Kawai Grand Piano?
by look_alive
07/06/15 12:32 AM
New Grand Piano Sample in Nord Piano Library
by PianoZac
07/05/15 11:03 PM
Professional translation into German about cardboard shim
by Maximillyan
07/05/15 10:45 PM
I went to teach at a Chinese piano factory
by Ed McMorrow, RPT
07/05/15 10:34 PM
Need help to remove Clavinova keyboard
by melwig
07/05/15 10:19 PM
What's Hot!!
New Forum for Selling Your Products or Services
--------------------
Historic Piano Documents
--------------------
Posting Pictures on the Forums
-------------------
Forums Rules & Help
-------------------
ADVERTISE
on Piano World

The world's most popular piano web site.
-------------------
PIANO BOOKS
Forum Stats
79,888 Registered Members
44 Forums
165,326 Topics
2,424,371 Posts

Most users ever online: 15,252 @ 03/21/10 11:39 PM

Visit our online store for gifts for music lovers

 
Help keep the forums up and running with a donation, any amount is appreciated!
Or by becoming a Subscribing member! Thank-you.
Donate   Subscribe
 
Our Piano Related Classified Ads
|
Dealers | Tuners | Lessons | Movers | Restorations | Pianos For Sale | Sell Your Piano |

Advertise on Piano World
| Subscribe | Piano World | PianoSupplies.com | Advertise on Piano World | Donate | Link to Us | Classifieds |
| |Contact | Privacy | Legal | About Us | Site Map | Free Newsletter | Press Room |


copyright 1997 - 2015 Piano World ® all rights reserved
No part of this site may be reproduced without prior written permission