HN Explorer

TrendMicro sends passwords in plain text - that's security

6 points by syrnick ↗ HN
I just subscribed to the online account and got this:

Dear Alex Sxxxxxx,

Thank you for registering Worry-Free Business Security Services for Dell. Your account will be activated immediately.

Account Information Service Name: Worry-Free Business Security Services for Dell Activation Code: WF-HMWA---------------------

Logon Information User Name: syrnick Password: PASSWORD IN PLAIN TEXT Validity: 455 days (2/7/2011 - 5/7/2012) Product/Service Console: https://wfbs-svc.trendmicro.com/dell/

With password in plain text that makes me worry - what do they know about security?

4 comments

[ 3.2 ms ] story [ 23.8 ms ] thread
FirstHopSystems
Yes, sending credentials in plain-text is bad. I would be more worried about your password being stored in plain text. That data is just sitting there...waiting. defended by super 1337 TrendMicro security!
cfinke
Since this password was sent in plain text at signup-time, there's a chance that it was still hashed/encrypted before being stored. Not a good chance, given the fact that they thought it was ok to send it in plain text at all, but still a chance.
yuhong
They are not the only ones. Many websites do this. Not only with signing up, but also with "forgot password" too.
drallison
What about Basic Authentication, the default authentication protocol for web pages. Credentials are passed encoded as base-64, hardly better than plain text in the open.

What would you propose as a better solution? Is there a difference in the level security you would want for a site like TrendMicro and the level of security you would want for your Bank Account?