Larian Studios Forums General About this website Plain Text Password Saving

So I'm working in WebDev and after making an account on here, I was pretty shocked to discover that the confirmation email had a section that said:


For your records, your login information is as follows:
Email: [My Email]
Password [My Password]

This is like, a serious SERIOUS security threat for every user on here, especially the ones that reuse their passwords a lot (Please use a password manager, people)
As soon as anyone manages to find their way into the user database, by hacking attack or a disgruntled employee with malicious intentions, they can expose every single password and email combination in a giant data leak.
This will probably cause millions in legal damages for Larian Studios.

I've seen threads from THREE YEARS ago that have pointed out that exact problem. The fact that this still isn't fixed is honestly very scary.
The solution to changing this would be to encrypt the passwords in the register function, then when the user logs in, comparing the thing they entered to the encrypted password in the database using the encryption functions provided by PhP (and any other language).

This isn't a big fix, this is just having someone change 2-5 lines of code and creating a script that converts the existing passwords.

I really hope this issue will be addressed before serious damage is going to happen.

I've seen some people from Support answer that issue with "The passwords are hashed after the email has been sent" But that honestly does not make it any better. That just means that in any step between entering the password and encrypting it, it can be read in memory. The emails themselves can also be intercepted and any man-in-the-middle attack will be able to access these passwords.

Passwords should NEVER be handled in plain text anywhere in the program except for the text field the user enters them into. This is the most basic thing in cyber security.

I just registered myself here and the first thing I noticed is this as well. Glad to see I'm not the only one noticing this. This is a serious issue and really should be fixed asap.

I was just looking for the right section to post this.

Yes, this is a gaping security flaw. Glad I'm not using the same password for my Larian account.

Even if it is hashed after before storing it in the database, I still think that they should not send out the password in an email.
If your email gets hacked or is hacked, they can easily find your password(which you should not), then you have an even bigger issue.