Welcome to the Piano World Piano Forums
Over 2.5 million posts about pianos, digital pianos, and all types of keyboard instruments
Join the World's Largest Community of Piano Lovers (it's free)
It's Fun to Play the Piano ... Please Pass It On!


SEARCH
Piano Forums & Piano World
(ad)
Modern Piano Moving
Modern Piano Moving
(ad)
Virtual Sheet Music
Download Sheet Music Instantly
Virtual Sheet Music - Classical Sheet Music Downloads
Sheet Music...
(125ad)
Piano Life Saver - Dampp Chaser
Dampp Chaser Piano Life Saver
(ad)
Piano Buyer Guide
Piano Buyer Spring 2017
(ad)
Lindeblad Piano
Lindeblad Piano Restorations and sales
Who's Online Now
99 registered members (alfredo capurso, AlanB, 36251, ando, accordeur, b54632, 28 invisible), 1,968 guests, and 9 spiders.
Key: Admin, Global Mod, Mod
(ad)
Estonia Pianos
Estonia Pianos
Quick Links to Useful Piano & Music Resources
Our Classified Ads
Find Piano Professionals-

*Piano Dealers - Piano Stores
*Piano Tuners
*Piano Teachers
*Piano Movers
*Piano Restorations
*Piano Manufacturers

Quick Links:
*Advertise On Piano World
*Free Piano Newsletter
*Online Piano Recitals
*Piano Recitals Index
*Piano & Music Accessories
*Live Piano Venues
*Music School Listings
* Buying a Piano
*Buying A Acoustic Piano
*Buying a Digital Piano
*Pianos for Sale
*Sell Your Piano
*How Old is My Piano?
*Directory/Site Map
*Virtual Piano
*Music Word Search
*Piano Videos
*Virtual Piano Chords & Scales
Previous Thread
Next Thread
Print Thread
#2036544 - 02/20/13 06:09 PM How about you don't send my password in a plain text email?  
Joined: Feb 2013
Posts: 1
DavidCa Offline
Junior Member
DavidCa  Offline
Junior Member

Joined: Feb 2013
Posts: 1
When I registered here, I immediately got an email saying welcome to the forum, your username is <blah> and your password is <blah>.

This is bad because anyone can see those emails. It compromises security of this site majorly. It also compromises the security of other sites if that user has used the same password elsewhere.

Please change this.

Piano & Music Accessories
#2191195 - 12/02/13 01:55 AM Re: How about you don't send my password in a plain text email? [Re: DavidCa]  
Joined: Nov 2013
Posts: 1,013
lolatu Offline
1000 Post Club Member
lolatu  Offline
1000 Post Club Member

Joined: Nov 2013
Posts: 1,013
UK
Agree - I was pretty shocked to receive this in plain text too. I've never seen any other site send a password like this, with the exception of randomly generated single-use passwords that must be changed immediately.

Now anyone who can read my gmail (Google, NSA, GCHQ etc) can also see my username and password for this site, which in itself doesn't matter that much, but what if I used something similar for my bank account or who-knows-where else?

It may also be an indication of deeper security problems you have here, since it suggests you're actually storing passwords on your server. You should NEVER store passwords - this is a schoolboy error - only a salted hash. Please tell me this isn't so... if it is, you have a huge security liability on your hands, and getting hacked or otherwise compromised would be disastrous for you and your users.


Kawai CA95 / Steinberg UR22 / Sony MDR-7506 / Pianoteq Stage + Grotrian / Galaxy Vintage D
In the loft: Roland FP3 / Tannoy Reveal Active / K&M 18810
#2192848 - 12/05/13 10:06 AM Re: How about you don't send my password in a plain text email? [Re: DavidCa]  
Joined: Mar 2013
Posts: 404
UKIkarus Offline
Full Member
UKIkarus  Offline
Full Member

Joined: Mar 2013
Posts: 404
England, South East
I'm pretty sure they would be storing salted hashes and the password being sent to the email is simply a copy of the value from the moment the form is submitted for registration as opposed to what is stored in the database.

They are however running a rather outdated version of the forum package which should ideally be updated, that said however I am fully aware of how difficult that can prove to be given that most end up changing the structure of templates/plugins so many of the originals no longer work/display correctly on the newer versions without some editing (in some cases A LOT of editing)

Perhaps this is why they have decided to stick with what they have for now?


Yamaha MOX8 Synthesizer

[Linked Image]
#2193471 - 12/06/13 01:06 PM Re: How about you don't send my password in a plain text email? [Re: DavidCa]  
Joined: Mar 2013
Posts: 404
UKIkarus Offline
Full Member
UKIkarus  Offline
Full Member

Joined: Mar 2013
Posts: 404
England, South East
Scratch that, the version is 7.5.7 which is fairly recent ...


Yamaha MOX8 Synthesizer

[Linked Image]

Piano Acc. & Gift Items in
Piano World's Online Store
In PianoSupplies.com ,(a division of Piano World) our online store for piano and music gifts and accessories, party goods, tuning equipment, piano moving equipment, benches, lamps Caster Cups and more.


Free Shipping on Jansen Artist Piano Benches
(ad)
Pearl River
Pearl River Pianos
ad
Pierce Piano Atlas


(ad)
Pianoteq
Grotrian Concert
Royal
for Pianoteq out now
What's Hot!!
Why Do You Play The Piano?
-------------------
Posting Pictures on the Forums
-------------------
Forums RULES & HELP
-------------------
ADVERTISE on Piano World
-------------------
Piano Classified Ads
New Topics - Multiple Forums
How about those spinets?
by RonTuner. 06/23/17 06:46 PM
Info re 60s era Grotrian
by Duke of Dunning. 06/23/17 06:24 PM
Student progress using acoustic or digital piano
by Duke of Dunning. 06/23/17 05:17 PM
Finally a potential solution
by Terry Michael. 06/23/17 04:27 PM
SS leg lock blocks
by Gene Nelson. 06/23/17 04:22 PM
(ad)
Sheet Music Plus
Sheet Music Plus Featured Sale
(ad)
Accu-Tuner
Sanderson Accu-Tuner
Forum Statistics
Forums44
Topics180,414
Posts2,638,499
Members88,169
Most Online15,252
Mar 21st, 2010
Check It Out!
There's a lot more to Piano World than just the forums.
Check It Out!
Visit our online store for gifts for music lovers


 
Help keep the forums up and running with a donation, any amount is appreciated!
Or by becoming a Subscribing member! Thank-you.
Donate   Subscribe
 
Our Piano Related Classified Ads
| Dealers | Tuners | Lessons | Movers | Restorations | Pianos For Sale | Sell Your Piano |

Advertise on Piano World
| Subscribe | Piano World | PianoSupplies.com | Advertise on Piano World |
| |Contact | Privacy | Legal | About Us | Site Map | Free Newsletter |


copyright 1997 - 2017 Piano World ® all rights reserved
No part of this site may be reproduced without prior written permission
Powered by UBB.threads™ PHP Forum Software 7.6.0