620576 - developer.mozilla.org Forgot Password flow - password in plain text in email.

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: Wiki pages, defect)

Description

[Austin King [:ozten]]

A follow on to Bug#620395. The forgot password flow also emails a replacement password in plain text.

Repro:
1) Go to https://developer-stage9.mozilla.org/Special:UserPassword
2) Enter an existing email

Actual
Note you've been emailed a plain text password

Expected
A url with a unique token that allows you to change your password

Note: You can also attack another deki user if you know their email address by periodically requesting a new password. Their real one won't work and they will have to check their email and re-login.

Unlike bug#620395 This is a design flaw and cannot be fixed via updating copy, as it would leave a user with no way to reclaim or change a password.

Long Term Fix: SSO will resolve this issue.
Short Term: Do we need to engage Mindtouch for a new Forgot Password flow?

Comment 1

[Michael Coates [:mcoates] (acct no longer active)]

Luke,

Thoughts on this bug? Will an upgrade fix this or do we need to reach out to mindtouch.  It would be great to get plain text passwords out of emails.

Comment 2

[Luke Crouch [:groovecoder]]

We upgraded MT to 10 recently. I'll check it again.

Comment 3

[Luke Crouch [:groovecoder]]

This is NOT fixed in MT 10.1 and still affects both staging and production. I've filed an issue with MT.

Comment 4

[Luke Crouch [:groovecoder]]

Raymond, were you able to find any bug with our own patch for this issue?

Comment 5

[raymond [:retornam] (inactive)]

(In reply to Luke Crouch [:groovecoder] from comment #4)
> Raymond, were you able to find any bug with our own patch for this issue?

i'm still digging through bugzilla. I'll update this bug when i find it

Comment 6

[Les Orchard [:lorchard]]

*facepalm* Yet another reason for bug 674635, so we can have more control over account management. I'm guessing it'll be easier to switch to Django auth than get Mindtouch to change their product.

At least it's the temporary password and not the permanent password, though we're still candidates for http://plaintextoffenders.com/

Comment 7

[Luke Crouch [:groovecoder]]

Raymond, did you ever find the old bug with a patch for this?

Comment 8

[raymond [:retornam] (inactive)]

(In reply to Luke Crouch [:groovecoder] from comment #7)
> Raymond, did you ever find the old bug with a patch for this? 

It might have been https://bugzilla.mozilla.org/show_bug.cgi?id=620395 . I can't tell since I am no longer cc'ed on the bug

Comment 9

[Luke Crouch [:groovecoder]]

yup, that's the one. there's a patch for it there.

Comment 10

[Luke Crouch [:groovecoder]]

This is fixed with the move to BrowserID! w00t!

Comment 11

[Austin King [:ozten]]

To the end of an era! Forgot Password Flow die!

Great work groovecoder

Comment 12

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.