Code
Is Your Email Safe?
Email this post
⋅ 
Print this post
⋅ Post a comment
It surprises me that there is not more fraud on the internet. In fact, it's enough to give a renewed faith in the majority people that run their own websites.
I'm a student, and in my spare time I do some web design, and some coding - among other things. I'd consider myself fairly adept at languages like PHP and Python, and during the past few years I've written a few proof-of-concept ideas that require users to create an account, and afterwards log in.
When most people think of internet fraud, they imagine hackers in darkened rooms logging passwords, and using them to steal bank details. Perhaps this does happen, even if t's rarely heard of. What I find surprisingly uncommon, though, is people's passwords being logged simply by the owners of the sites that they visit.
Consider this. If you were to create an account on this site, or for that matter almost any other website, it would be child's play for the webmaster of that site (in the case of BlueSunCorp that would be myself or Richard) to retrieve the password you use, and the email associated with it. Obviously I'm not going to do that, but imagine what I could do with those details:
- Deny you access to your email
- Reset account passwords on practically any other site you've signed up for - given that most sites send a randomly generated password to your email when you ask them to
- Log into Paypal and other online banking systems. Paypal at the very least uses your email address as a login, so if you have one password which fits all, this would be like robbing candy from a baby
- Wreak general havoc in your name
Essentially, I would practically have the power to steal your online identity, and given the scale of some individual's presences across the internet (myself included), the implications for this would be fairly massive, on a personal level.
The solution? At the very least, have a different password for your email account. That's it. Your email account, along with the associated password, is the quickest gateway for accessing most of your online data, and it's a scary thought. So keep it safe from sites you're not totally sure about.
This isn't meant as a scare-story, or a reason to avoid signing up to sites. It's just a warning; if you imagine what your email addresses password can anable people to do, do you really want it in anyone's database?
Popularity: 3%
1 votes, average: 5 out of 5
Loading ...Discussion
8 comments for “Is Your Email Safe?”
Post a comment
isn't your php code wrong anyway? don't you want == intead of = in comparing the POST password/email with the variables $email/$pwd?
Thames - no, the point is the variables are being assigned in the condition. Admittedly I had them the wrong way around the first time, but the single = is correct.
Why not just skip the 2 if statements and do
hmm, it nicely stripped my tags out,
pwd_log($_POST['email'], $_POST['password'])
Two reasons:
- The code is supposed to check if those values aren't null
- I needed a nice graphic for the top of the post, 2 lines wouldn't cut it. ;)
A long time ago I had a service where someone with a plugin in winamp could post their current song in a small graphic for use in forums. I shut the service down (I wasn't a programmer then and I'm not now so all the passwords in the first version were plain text). But nobody noticed the service was down, but 1000s of hits were coming from forums. So 95% of the forum accounts that were killing my bandwidth I was able to log in with the same password and remove the graphic myself :) Bad, isn't it?
Well, if the webmaster has coded things properly, or even used one of the many open source solutions as a base for his site management, those passwords are probably hashed, and nontrivial to recover.
So unless your webmaster is using bad practices, there's no reason to trust him at all.
Kate: the strings are coming in from the client in plain text; hashes are neither here nor there. The point is "don't share passwords between sites".