5 ms·

As it was said before, careful with what you are saying. That looks like a welcome email, which was sent as soon as you registered (password not encrypted yet)

by fuj 12y ago

As it was said before, careful with what you are saying. That looks like a welcome email, which was sent as soon as you registered (password not encrypted yet) which is not a good idea anyway, but still, far from the security issue it would be if they were stored in plaintext.

negativity 12y ago
I dunno, it's still pretty debatable, since e-mail isn't guaranteed to be encrypted over the wire, which leaves people open to MITM attacks. So consider a situation where someone receives a password in plain text, and the password never expires and never gets changed by the user. All things considered, a token is a token, so whether the "password" is sent in plaintext, or whether a nonce hex key is provided by e-mail, anything sent by e-mail should have a shelf life, even if it's a relatively long one of like 30 days. Ideally, it should expire in hours or minutes. If they don't get around to it fast enough, you have the user's e-mail, just tell them you need to send them another, because the last one expired. That way, you're forcing a live user to interact with the system, and act quickly, to establish proper authentication credentials.
cflyingdutchman 12y ago
I also received this email, just prior. The password they created for me was one I use for my general TrueBlue account. There was no sign-up process for TravelBank: " Hello Cole Welcome to our credit tool, Travel Bank, which allows customers to manage their credits with JetBlue. An account has been created for you with the account number and username below. You can view your transactions by clicking Here. For your security, your password has been sent in a separate email. Travel Bank Account Number: xxxxxxxxxxxxxxx Username: xxxxxxxxxxxxxxx As a TrueBlue member, you can easily manage this account, including updating your password, when you sign in to TrueBlue. (Not a member yet? Register here). To book a flight using your Travel Bank credit, visit jetblue.com and choose Travel Bank as your form of payment. If you are a CompanyBlue Administrator, your travelers will log into your CompanyBlue account and book normally. Once Travel Bank access is granted to the appropriate travelers, they will be able to use it as a form of payment in the booking flow. For more details, refer to your CompanyBlue training materials. We hope you find Travel Bank a useful tool for managing your credits. If you require further assistance, please visit the help section of our website. Sincerely, "

by fuj 12y ago

negativity 12y ago

I dunno, it's still pretty debatable, since e-mail isn't guaranteed to be encrypted over the wire, which leaves people open to MITM attacks. So consider a situation where someone receives a password in plain text, and the password never expires and never gets changed by the user. All things considered, a token is a token, so whether the "password" is sent in plaintext, or whether a nonce hex key is provided by e-mail, anything sent by e-mail should have a shelf life, even if it's a relatively long one of like 30 days. Ideally, it should expire in hours or minutes. If they don't get around to it fast enough, you have the user's e-mail, just tell them you need to send them another, because the last one expired. That way, you're forcing a live user to interact with the system, and act quickly, to establish proper authentication credentials.

cflyingdutchman 12y ago

I also received this email, just prior. The password they created for me was one I use for my general TrueBlue account. There was no sign-up process for TravelBank: " Hello Cole Welcome to our credit tool, Travel Bank, which allows customers to manage their credits with JetBlue. An account has been created for you with the account number and username below. You can view your transactions by clicking Here. For your security, your password has been sent in a separate email. Travel Bank Account Number: xxxxxxxxxxxxxxx Username: xxxxxxxxxxxxxxx As a TrueBlue member, you can easily manage this account, including updating your password, when you sign in to TrueBlue. (Not a member yet? Register here). To book a flight using your Travel Bank credit, visit jetblue.com and choose Travel Bank as your form of payment. If you are a CompanyBlue Administrator, your travelers will log into your CompanyBlue account and book normally. Once Travel Bank access is granted to the appropriate travelers, they will be able to use it as a form of payment in the booking flow. For more details, refer to your CompanyBlue training materials. We hope you find Travel Bank a useful tool for managing your credits. If you require further assistance, please visit the help section of our website. Sincerely, "