13 ms·

Only if the send you your old password. If they reset your password, they can send you the plaintext first, then hash the password and store it in the database.

jlarocco 11y ago
No. The problem is that email isn't encrypted on the backend. Sending a plain text password means every server between the website's SMTP server and your email provider's SMTP server can see the password.
- NeutronBoy 11y ago
  As opposed to what? Every server between the website's SMTP server and your email provider's SMTP server can see the password reset link?
  - ajanuary 11y ago
    When implemented correctly, password reset links a) Work once. If you click on a password reset link and it says it's already been used, you know something is up, v.s. someone using the plaintext password to log in before you and you are non the wiser. b) Expire. Lot's of people won't bother changing the password that was given to them, so anyone who comes across a plaintext password in the email at a later date would be able to log in.
    - NeutronBoy 11y ago
      Both of these things can be true with temporary plaintext passwords.
      - ajanuary 11y ago
        Temporary plaintext passwords are rare; I don't think I've ever seen one. If you've got as far as temporary plaintext passwords, I'd argue it's a better UX to provide a simple link instead of forcing them to copy and paste something.
      - tripzilch 11y ago
        > Both of these things can be true with temporary plaintext passwords. In that sense, a password reset link is equivalent to a temporary plaintext password. Except it's got better usability, being a link that you can click on.
- shkkmo 11y ago
  Not quite true. A properly configured email server sending email to another properly configured email server should be using TLS to send the message: http://superuser.com/questions/260002/why-are-email-transfers-between-mail-servers-often-not-encrypted http://superuser.com/questions/260002/why-are-email-transfer... That still doesn't mean you should count on emails being encrypted between servers.

jlarocco 11y ago

No. The problem is that email isn't encrypted on the backend. Sending a plain text password means every server between the website's SMTP server and your email provider's SMTP server can see the password.

NeutronBoy 11y ago
As opposed to what? Every server between the website's SMTP server and your email provider's SMTP server can see the password reset link?
- ajanuary 11y ago
  When implemented correctly, password reset links a) Work once. If you click on a password reset link and it says it's already been used, you know something is up, v.s. someone using the plaintext password to log in before you and you are non the wiser. b) Expire. Lot's of people won't bother changing the password that was given to them, so anyone who comes across a plaintext password in the email at a later date would be able to log in.
  - NeutronBoy 11y ago
    Both of these things can be true with temporary plaintext passwords.
    - ajanuary 11y ago
      Temporary plaintext passwords are rare; I don't think I've ever seen one. If you've got as far as temporary plaintext passwords, I'd argue it's a better UX to provide a simple link instead of forcing them to copy and paste something.
    - tripzilch 11y ago
      > Both of these things can be true with temporary plaintext passwords. In that sense, a password reset link is equivalent to a temporary plaintext password. Except it's got better usability, being a link that you can click on.
shkkmo 11y ago
Not quite true. A properly configured email server sending email to another properly configured email server should be using TLS to send the message: http://superuser.com/questions/260002/why-are-email-transfers-between-mail-servers-often-not-encrypted http://superuser.com/questions/260002/why-are-email-transfer... That still doesn't mean you should count on emails being encrypted between servers.