Quote from: jfourmo on June 24, 2011, 01:36:21 PM

and thanks for sending my password clear text in the welcome e-mail

It is not uncommon for the initial "welcome" email to contain your username and password, especially for websites that do not keep credit card information. Assuming your email remains secure, your only concern with an emailed password is a "man in the middle" due to the fact that email is transmitted in plaintext.

The password is stored in the database as a per user salted hash, so if you do a "password lookup" , it emails you a onetime key to login and be able to change it. Once again, this is vulnerable to a "man in the middle" , but given it's one time usability , less so.

Seeing as how it was simply a design issue to include the password in the email, and this is a security conscious community, I removed it.

Peter Azuolas
Lead Developer
MiningMonitor.com