Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Although a lot of sites still send your password in plain text through email, there has been a push to send a web page url instead.

But how can that be any more secure than the password in clear text? If someone is going to intercept your email, they get your password either way. So isn't sending the url through email just an illusion of security?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

If you're emailed your password and three months later someone gets access to your email, they can get into your account (unless you've changed the password, which is unlikely). If you're emailed a password reset link and three months later someone gets into your account it won't do anything, because even if you've not used it, it will have expired. It drastically reduces the time window in which an email compromise can give the attacker access to your account.

share|improve this answer
    
This is what I was looking for. It's easy to generate an email from the sign-up form at that time since the password is unencrypted as it's typed. I habitually delete emails with important data in them, it's easy to forget that other people don't always have the same habits. –  Maelish May 11 at 18:33
    
What Scott forgot to mention is that even if you delete your emails, that email will have been seen by countless other public email servers along the way. The reset link should be a single use link, so when if someone were to steal it and use it you would know. –  Aron May 12 at 12:26

It's not about emailing plain text passwords vs. a URL, it's about storing passwords in plain text vs. hashing them. Storing passwords in plain text is not considered secure because if the site (or server, or database...) is exploited, the hacker has access to the user's account on that site along with any other site on which they use the same username and password. A correctly hashed (and salted) password does not have this vulnerability.

A site that is storing passwords securely can't email you your password, because it doesn't know what your password is. That's why a non-guessable URL that allows you to reset your password is sent instead.

If the system you're securing is sensitive enough that you want to protect users from having their email hacked, consider using two factor authentication for an added layer of security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.