Forum registration pwd sent to me in PLAIN TEXT! Nooo...

Thanks - I've just removed that from the phpBB forum software's default email templates.

-Chris

it's sent before the password's actually hashed.

that being said, are the forums still storing passwords using phpBB2's default hash (because linode cba to run the latest version, and this version has known CSRF openings…)?

which by the way, the hashing method is a simple md5()…

It's just a forum password.

Don't wet yourself over it.

The same message is sent if the account is created for you so it would be telling what the password was that you didn't create. It should include a message saying you should change your password after you successfully login the first time. This time using a better more secure password. You don't get an email when you change your password.

Not sure what phpBB uses now days to store the password. been years since I ran one. I do have a number of SMF forums and it uses salted SHA1 and the original is not saved. One way street. and it is not the same access as your Linode host.

@vonskippy:

It's just a forum password.

Don't wet yourself over it.

:-) Pants are dry.

I use 1Password, so I don't really care. A lot of people don't, however, and it seems like such an obviously silly thing to do.

Anyway, thanks Chris for removing that from the template.