..to think people shouldn't store your password or email it to you?

[PetraDelphiki]

I just joined the National Landlords Association and they have very kindly just emailed me to tell me my account number and security code (in plain text)...honestly do they not know anything about computer security????

Particularly when they insist on extremely secure passwords - they won't let you enter one without numbers, letters and punctuation!

Well, obviously they need to store your password,but it should be encrypted, and no, they should not be emailing it to you in plaintext, although in reality the risk is fairly low.

Sites that do this tend to send out a unique but nonsense password say 23AbQwerty10 this is used to varify you've logged in for the first time and then when you log in you can not enter the actual site until you change the password!

Oh is it a password you've entered rather than one just given to you for the first log in then no they shouldn't be sending to you in plain text!

Nope it was the one I entered!! And they never need to store anything other than the hash of the password ! Good design suggests that you shouldn't be able to recover your password from their servers...if you lose it you should have to reset!

I know the risk is pretty low it just really annoys me!

Mate no one is going to hijack your account. For what.....a landlord obligation legal guide? Just make sure you protect the deposit and chill dude

Cool surfer I think it's more the principle of it it shouldn't be done!

Absolutely it's the principle of the thing...plus unless you are one of the very few people who have completely separate passwords for everything you do, sight of one password could give access to a whole host of other things...as various people found out here recently!

Plus website designers should know better!!!!

It's even worse...they sent me my joining pack...with my security code in plain text in the letter!!!

Do they not know ANYTHING about website security??????

That's absolutely ridiculous, can you refuse to work with them? They have an absolutely massive security failure and apparently don't give a shit or are just incredibly ignorant.

What how in this day an age do they think this is a way to conduct an online business?

I would have thought not sending passwords in plain text by post was rule number 1!

Before anyone goes it's only this and no ones going to hack the account possiably not but to not use such basic procedures to me is slightly worrying and it could have been another organisation using such lax security

I'm on a few sites where if you forget your assword they send it to you. I'm very grateful, i have to many to remember.

They do Kali but it's better to say you have to reset it it's easy you just send a password reset to the registered email

To be fair, if anyone wanted to enter your account and had access to your email, then sending a password or a link to reset it's pretty much the same.

I've got my password in plain text in (plenty of) recent emails. It's not a big deal to me.