TrendMicro sends passwords in plain text - that's security

https://news.ycombinator.com/item?id=2187551

by syrnick • 15 years ago

6 4 15 years ago

news.ycombinator.com

I just subscribed to the online account and got this:

Dear Alex Sxxxxxx,

Thank you for registering Worry-Free Business Security Services for Dell. Your account will be activated immediately.

Account Information Service Name: Worry-Free Business Security Services for Dell Activation Code: WF-HMWA---------------------

Logon Information User Name: syrnick Password: PASSWORD IN PLAIN TEXT Validity: 455 days (2/7/2011 - 5/7/2012) Product/Service Console: https://wfbs-svc.trendmicro.com/dell/

With password in plain text that makes me worry - what do they know about security?

FirstHopSystems• 15 years ago

Yes, sending credentials in plain-text is bad. I would be more worried about your password being stored in plain text. That data is just sitting there...waiting. defended by super 1337 TrendMicro security!

cfinke• 15 years ago

Since this password was sent in plain text at signup-time, there's a chance that it was still hashed/encrypted before being stored. Not a good chance, given the fact that they thought it was ok to send it in plain text at all, but still a chance.

yuhong• 15 years ago

They are not the only ones. Many websites do this. Not only with signing up, but also with "forgot password" too.

drallison• 15 years ago

What about Basic Authentication, the default authentication protocol for web pages. Credentials are passed encoded as base-64, hardly better than plain text in the open.

What would you propose as a better solution? Is there a difference in the level security you would want for a site like TrendMicro and the level of security you would want for your Bank Account?

TrendMicro sends passwords in plain text - that's security

Related Stories