Clear Text Passwords
-
Hi!
Can we :
1: Disable the sending of clearrtext passwords via email totally
OR
2: at least get a checkbox in the admin that prevents it from being sent?Cleartext passwords are a very bad idea and sending them via email is even worse.
Strictly IMHO, it would be better for you to store the hashed password upon registration instead of the cleartext version. This would be safer all around.
Also, I’m not exactly sure why this plugin is storing the password the user enters as cleartext in the signups table of the database, but is there a way we can not do that?
I like most of what this plugin does but storing the password in cleartext instead of just using WordPress’s hashed version, and then sending them in email are both very bad practices from a security point of view.
Cheers!
=C=
- The topic ‘Clear Text Passwords’ is closed to new replies.
