Big no-no: At login, you just sent me my password in clear text via email. You should never, ever be able to retrieve my clear text password, even just in order to send it to me.
back
3 comments
Yeah... I'm not super surprised by this really. Initially it looked fine, but the more I looked at the design and way the site worked, the more I realized it was really questionable in quality. For example:
- "Infographics are 30 to 40 times more likely to be viewed and shared vs. text." - an un-cited statistic they put upfront. almost ironic
- Left and right arrows don't do anything, they just hash the url
- Their feedback url isn't an actual place for feedback, it's a survey
- Click login - the back end is wordpress (?!)
- If you view the source, you can quickly see that this was made with a pre-assembled wordpress theme (http://test.nattywp.com/preview.php?theme=ifolio)
- The rest of the source is an absolute mess with inline styles and scripts
... if this is the amount of effort put into the landing page, it's hard to trust the rest of it...
If they sent it to you at signup, it doesn't necessarily mean that they're storing it without encryption.
The only time a server should see a password is when it's generating or comparing against the salted hash using something like bcrypt. There should never be a way for a server to retrieve the plain text password. Ever.
Email isn't sent in an encrypted form by default so this still indicates a serious concern. Either they a) don't hash passwords or b) are happy sending passwords in cleartext across the internet to machines that you don't directly control.
Given that it's http://www.easel.ly/ and not https://www.easel.ly/, b) kind of goes without saying.
The other replies to this comment are correct, but just to be clear: USER PASSWORDS SHOULD NEVER BE STORED ON THE SERVER, EVEN IN ENCRYPTED FORM.
Correct, you should hash them. Preferably with an algorithm designed for password hashing.
That's because they're using WordPress, emailing passwords is how WordPress works.