vcsjones

I have just signed up for a website. (OK, not really, but let's pretend). Like most websites these days, it requires some sort of registration. Basically it asks for a username, e-mail, and a password. So I fill all this stuff out, and click "OK".

a few seconds later, Outlook pops up saying I got a new e-mail. [Open e-mail]. So I got a registration e-mail. Nice, friendly, welcoming. Uh oh, why did they e-mail me the password I registered? I don't like that. Here's why:

1. E-Mail isn't secure. Most people don't use digital certificates to encrypt e-mails. That is used mostly for within companies. So when I get an e-mail with my password in it, there is always the chance that it was intercepted.
2. Some people are careless with E-Mail. They will sign onto a public computer (Library, Computer Café, etc) and forget to sign out (Don't ever do that!!). 10 minutes late someone comes by, opens GMail to see someone else already signed in. He does a quick scan of the subjects and picks out something like "Welcome to a site that E-Mails your password!"
3. Typical people have one password for everything. So if one e-mail is intercepted or read, they have a password that will probably work with other things, in the worst scenario, online banking or other private sites.

There is also another thing that could be a security risk. Say I forget my password, go to rest it. I answer some silly question like "What's your dog's name?" and I get an e-mail with my password in it. That is a red flag for several reasons:

1. A lot of people know my dog's name.
2. That indicates to me that the site is storing my password in a reversible state. (Possibly even worse, as clear text) I don't follow that practice, and don't advocate it either. A good policy to have is always store passwords using a one way algorithm, such a one way encryption or hashing. That way, if the database were ever compromised, the passwords would be in an irreversible state, still safe.
3. The company that is running the database might have a bad apple. Someone that was recently fired, thinks they need more pay, or just a lunatic. They could take the passwords and sell them on the internet.

E-Mail inboxes are a bad repository for passwords. If you find a site that is e-mailing you your password, you might want to consider a handy trick one of my co-workers, Bryce, suggested. His idea is salt your password with something about the site. For instance, use your regular password, then add 3 characters from the domain name somewhere in your password. That makes it unique, and it acts as a salt, so if the site is hashing passwords (we can't guarantee they are salting it for you). Though, the best practice is to have a totally unique password for important things.