Skip to content

Instantly share code, notes, and snippets.

@colinbowern
Last active September 4, 2017 02:11
Show Gist options
  • Save colinbowern/8a33e6efb4d825c737ff96a1bc3d63e7 to your computer and use it in GitHub Desktop.
Save colinbowern/8a33e6efb4d825c737ff96a1bc3d63e7 to your computer and use it in GitHub Desktop.
Clear Text Password in Email Response

Hi team,

I see you that you have shared my password over email. 😞 The protocol underlying email, SMTP, is like a postcard - every device handling the message along the way can read the contents of it. You should be storing passwords using a one-way encryption function so that if your customer database were compromised that it would not expose clear text passwords. The reality is that people reuse passwords all of the time, and that exposure could not only hurt your business, but also expose other accounts that person uses.

I hope you will address this issue, and review any credit card number handling procedures as well as there is a strong correlation between poor password handling and credit card handling, the latter of which puts your merchant facilities at risk through the Payment Card Industry Data Security Standards.

Cheers, Colin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment