Is HostGator storing my password in plaintext?Is it better to hash n*x times in sha1 or n times in sha512 on the client side?Definitely safest password storage scheme?Forgot Password? - sends email with plaintext passwordIs it ok for software to store passwords locally in plain-text?Finding Plaintext Password RepositoriesHow to avoid storing plaintext during CHAP authenticationReceived an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?Storing Password Hash plaintextThird party program is storing a password in a DSN. Is it a security threat?Methods for storing plaintext passwords on a client

Why does John Bercow say “unlock” after reading out the results of a vote?

Is the destination of a commercial flight important for the pilot?

What will be the benefits of Brexit?

If you attempt to grapple an opponent that you are hidden from, do they roll at disadvantage?

How can I use the arrow sign in my bash prompt?

Is it okay / does it make sense for another player to join a running game of Munchkin?

The baby cries all morning

Can somebody explain Brexit in a few child-proof sentences?

Curses work by shouting - How to avoid collateral damage?

How could Frankenstein get the parts for his _second_ creature?

What to do with wrong results in talks?

Have I saved too much for retirement so far?

Cynical novel that describes an America ruled by the media, arms manufacturers, and ethnic figureheads

Finding all intervals that match predicate in vector

How will losing mobility of one hand affect my career as a programmer?

Failed to fetch jessie backports repository

Trouble understanding overseas colleagues

Is there a problem with hiding "forgot password" until it's needed?

Is expanding the research of a group into machine learning as a PhD student risky?

How to be diplomatic in refusing to write code that breaches the privacy of our users

Can I Retrieve Email Addresses from BCC?

Should my PhD thesis be submitted under my legal name?

What are the ramifications of creating a homebrew world without an Astral Plane?

Personal Teleportation as a Weapon



Is HostGator storing my password in plaintext?


Is it better to hash n*x times in sha1 or n times in sha512 on the client side?Definitely safest password storage scheme?Forgot Password? - sends email with plaintext passwordIs it ok for software to store passwords locally in plain-text?Finding Plaintext Password RepositoriesHow to avoid storing plaintext during CHAP authenticationReceived an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?Storing Password Hash plaintextThird party program is storing a password in a DSN. Is it a security threat?Methods for storing plaintext passwords on a client













3















I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.



I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:



enter image description here



I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?



enter image description here










share|improve this question









New contributor




Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.















  • 1





    Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.

    – schroeder
    3 hours ago






  • 1





    @schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.

    – Marquizzo
    3 hours ago











  • Ok, that all good info to have.

    – schroeder
    3 hours ago











  • It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.

    – Patrick Mevzek
    2 hours ago











  • The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.

    – Future Security
    2 hours ago















3















I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.



I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:



enter image description here



I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?



enter image description here










share|improve this question









New contributor




Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.















  • 1





    Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.

    – schroeder
    3 hours ago






  • 1





    @schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.

    – Marquizzo
    3 hours ago











  • Ok, that all good info to have.

    – schroeder
    3 hours ago











  • It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.

    – Patrick Mevzek
    2 hours ago











  • The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.

    – Future Security
    2 hours ago













3












3








3








I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.



I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:



enter image description here



I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?



enter image description here










share|improve this question









New contributor




Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.












I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.



I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:



enter image description here



I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?



enter image description here







passwords databases web-hosting






share|improve this question









New contributor




Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.











share|improve this question









New contributor




Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









share|improve this question




share|improve this question








edited 3 hours ago







Marquizzo













New contributor




Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









asked 3 hours ago









MarquizzoMarquizzo

1185




1185




New contributor




Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.





New contributor





Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.






Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.







  • 1





    Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.

    – schroeder
    3 hours ago






  • 1





    @schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.

    – Marquizzo
    3 hours ago











  • Ok, that all good info to have.

    – schroeder
    3 hours ago











  • It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.

    – Patrick Mevzek
    2 hours ago











  • The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.

    – Future Security
    2 hours ago












  • 1





    Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.

    – schroeder
    3 hours ago






  • 1





    @schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.

    – Marquizzo
    3 hours ago











  • Ok, that all good info to have.

    – schroeder
    3 hours ago











  • It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.

    – Patrick Mevzek
    2 hours ago











  • The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.

    – Future Security
    2 hours ago







1




1





Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.

– schroeder
3 hours ago





Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.

– schroeder
3 hours ago




1




1





@schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.

– Marquizzo
3 hours ago





@schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.

– Marquizzo
3 hours ago













Ok, that all good info to have.

– schroeder
3 hours ago





Ok, that all good info to have.

– schroeder
3 hours ago













It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.

– Patrick Mevzek
2 hours ago





It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.

– Patrick Mevzek
2 hours ago













The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.

– Future Security
2 hours ago





The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.

– Future Security
2 hours ago










2 Answers
2






active

oldest

votes


















7














Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).



Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.



Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.






share|improve this answer























  • That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.

    – Marquizzo
    2 hours ago











  • You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.

    – psosuna
    1 hour ago



















-3














We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.






share|improve this answer










New contributor




Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.




















  • I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?

    – Marquizzo
    3 hours ago











  • @Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.

    – Jason Michaels
    3 hours ago











  • @Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?

    – Jason Michaels
    3 hours ago






  • 1





    @JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.

    – Peteris
    2 hours ago











  • Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.

    – Jason Michaels
    2 hours ago










Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "162"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);






Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.









draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206186%2fis-hostgator-storing-my-password-in-plaintext%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























2 Answers
2






active

oldest

votes








2 Answers
2






active

oldest

votes









active

oldest

votes






active

oldest

votes









7














Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).



Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.



Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.






share|improve this answer























  • That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.

    – Marquizzo
    2 hours ago











  • You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.

    – psosuna
    1 hour ago
















7














Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).



Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.



Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.






share|improve this answer























  • That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.

    – Marquizzo
    2 hours ago











  • You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.

    – psosuna
    1 hour ago














7












7








7







Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).



Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.



Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.






share|improve this answer













Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).



Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.



Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.







share|improve this answer












share|improve this answer



share|improve this answer










answered 3 hours ago









CBHackingCBHacking

10.9k11627




10.9k11627












  • That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.

    – Marquizzo
    2 hours ago











  • You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.

    – psosuna
    1 hour ago


















  • That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.

    – Marquizzo
    2 hours ago











  • You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.

    – psosuna
    1 hour ago

















That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.

– Marquizzo
2 hours ago





That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.

– Marquizzo
2 hours ago













You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.

– psosuna
1 hour ago






You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.

– psosuna
1 hour ago














-3














We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.






share|improve this answer










New contributor




Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.




















  • I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?

    – Marquizzo
    3 hours ago











  • @Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.

    – Jason Michaels
    3 hours ago











  • @Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?

    – Jason Michaels
    3 hours ago






  • 1





    @JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.

    – Peteris
    2 hours ago











  • Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.

    – Jason Michaels
    2 hours ago















-3














We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.






share|improve this answer










New contributor




Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.




















  • I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?

    – Marquizzo
    3 hours ago











  • @Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.

    – Jason Michaels
    3 hours ago











  • @Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?

    – Jason Michaels
    3 hours ago






  • 1





    @JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.

    – Peteris
    2 hours ago











  • Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.

    – Jason Michaels
    2 hours ago













-3












-3








-3







We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.






share|improve this answer










New contributor




Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.










We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.







share|improve this answer










New contributor




Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









share|improve this answer



share|improve this answer








edited 3 hours ago









schroeder

78k30173209




78k30173209






New contributor




Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









answered 3 hours ago









Jason MichaelsJason Michaels

11




11




New contributor




Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.





New contributor





Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.






Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.












  • I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?

    – Marquizzo
    3 hours ago











  • @Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.

    – Jason Michaels
    3 hours ago











  • @Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?

    – Jason Michaels
    3 hours ago






  • 1





    @JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.

    – Peteris
    2 hours ago











  • Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.

    – Jason Michaels
    2 hours ago

















  • I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?

    – Marquizzo
    3 hours ago











  • @Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.

    – Jason Michaels
    3 hours ago











  • @Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?

    – Jason Michaels
    3 hours ago






  • 1





    @JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.

    – Peteris
    2 hours ago











  • Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.

    – Jason Michaels
    2 hours ago
















I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?

– Marquizzo
3 hours ago





I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?

– Marquizzo
3 hours ago













@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.

– Jason Michaels
3 hours ago





@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.

– Jason Michaels
3 hours ago













@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?

– Jason Michaels
3 hours ago





@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?

– Jason Michaels
3 hours ago




1




1





@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.

– Peteris
2 hours ago





@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.

– Peteris
2 hours ago













Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.

– Jason Michaels
2 hours ago





Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.

– Jason Michaels
2 hours ago










Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.









draft saved

draft discarded


















Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.












Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.











Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.














Thanks for contributing an answer to Information Security Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206186%2fis-hostgator-storing-my-password-in-plaintext%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Can not update quote_id field of “quote_item” table magento 2Magento 2.1 - We can't remove the item. (Shopping Cart doesnt allow us to remove items before becomes empty)Add value for custom quote item attribute using REST apiREST API endpoint v1/carts/cartId/items always returns error messageCorrect way to save entries to databaseHow to remove all associated quote objects of a customer completelyMagento 2 - Save value from custom input field to quote_itemGet quote_item data using quote id and product id filter in Magento 2How to set additional data to quote_item table from controller in Magento 2?What is the purpose of additional_data column in quote_item table in magento2Set Custom Price to Quote item magento2 from controller

How to solve knockout JS error in Magento 2 Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern) Announcing the arrival of Valued Associate #679: Cesar Manara Unicorn Meta Zoo #1: Why another podcast?(Magento2) knockout.js:3012 Uncaught ReferenceError: Unable to process bindingUnable to process binding Knockout.js magento 2Cannot read property `scopeLabel` of undefined on Product Detail PageCan't get Customer Data on frontend in Magento 2Magento2 Order Summary - unable to process bindingKO templates are not loading in Magento 2.1 applicationgetting knockout js error magento 2Product grid not load -— Unable to process binding Knockout.js magento 2Product form not loaded in magento2Uncaught ReferenceError: Unable to process binding “if: function()return (isShowLegend()) ” magento 2

Nissan Patrol Зміст Перше покоління — 4W60 (1951-1960) | Друге покоління — 60 series (1960-1980) | Третє покоління (1980–2002) | Четверте покоління — Y60 (1987–1998) | П'яте покоління — Y61 (1997–2013) | Шосте покоління — Y62 (2010- ) | Посилання | Зноски | Навігаційне менюОфіційний український сайтТест-драйв Nissan Patrol 2010 7-го поколінняNissan PatrolКак мы тестировали Nissan Patrol 2016рвиправивши або дописавши її