Considering that the password must have been stored in plaintext even before it was emailed to you, you should stop reusing the same password for different websites. If you are using the same password on multiple sites, you should realize that at least one of those sites probably has your password stored in plaintext.

Not doing business with them is a solution.

What @Wildcard said: different sites get different passwords. Because: xkcd.com/792 Also: a) get a password manager. KeePass is free. b) Select a good master password for the password manager. Again, xkcd to the rescue: xkcd.com/936

I use KeePass for just about everything, there were a few older accounts hanging around that used the same password.

Did they email you the forgotten password, or a new password that enables you to enter a password reset form? If the former, that's a case for plaintextoffenders.com, in the latter case I don't see anything insecure about this.

@Wildcard: not sure if it is stored in plaintext. OP went to "reset his password" and possibly had a new one generated and sent by email at the same time - and then hashed/salted/whatever for storage. this is still a bad practice (plaintext password in an email) but it might be stored correctly.

@Bergi: the insecure part is that his password is in plaintext in the email (for your latter case). It is therefore visible for possibly more people than the OP only (family, snoopers, shoulder surfing, email company, etc.)

I find flagging it up on social media can be a good way to get their attention.

@WoJ then why did he have to change passwords on other sites? Reread question.

@Wildcard: you are right "(...) ensuring new and unique password for every other site I used it on" indeed means that he did use it elsewhere before requesting a reset. So yes, they are really, really bad then.

@WoJ A new password is nothing different from the token in a password reset link or any other technique. Whatever the reset email contains, it allows you to log into the account one way or another. Of course this needs security measures/improvements such as limiting the time in which the token can be used, making it long enough not to be easily remembered by shoulder-surfers, and requiring to choose a new password when the reset happens, but all of those would be possible with a "plaintext password" as well.

@Bergi: it is very much different, among others for the reasons you described. A proper reset link is unique, on-time-use, time-limited and has a long key. Once used, it is useless and can stay in the mail (or its trashbin, as it will likely be deleted). A password is there to stay and you even cannot prevent that fi you want - this is the only way to set a password (which is actually set for you) so you have to read the mail, copy the password to your password management program and hope for the best. You would not even know that is has leaked. A non-working reset password is a red flag.

What TheJulyPlot said and TrustPilot would be a great start.

@WoJ you might have missed the other half of Bergi's comment: "Of course this needs security measures/improvements such as limiting the time in which the token can be used, making it long enough not to be easily remembered by shoulder-surfers, and requiring to choose a new password when the reset happens, but all of those would be possible with a "plaintext password" as well."

@DanHenderson: you mean a one-time-use, short-lived, complicated password which you would use to login and be presented with a "set a new password" screen? In that case yes of course. But for me this is not different from a confirmation key/token, appended or not to a reset link. Whatever this is called is a matter of semantics, and this thing will not be used as a classical password you (re)use to log in. My point is that what is sent by mail must not be persistant (so the classical password sent by email "to simplify the things for the user" is a big issue).

A site I used (note past tense) quite recently had an Ajax request on its login Form that returned a json array of every user record including email addresses and plaintext passwords. It then verified the Form entry against this array on the client side. I informed them (spoke to the company director and lead developer of that company directly). To this date they have not changed it. Suffice to say we don't do business with them any more.

@DarrenH you mean i.redd.it/auvi7ijfursy.png reddit.com/r/programminghorror/comments/66klvc/…

@DouglasGaskell oh no much worse, at least that script waits until the user clicks something rather than doing it on every page load (including the sign up Form) and doesn't conveniently output it to console for you

@Wildcard while the password had to be stored in a form recoverable to the password reset functionality, that doesn't mean it was plaintext. It could as easily be encrypted, potentially even using password reset 'secrets' as the encryption key (or seed). That said, as soon as a password is used for a site, it's not safe to use elsewhere - unless you want that site to log in as you elsewhere.

additionally, WD may not be protecting anything they see of value, and therefore they may not care to set up a secure login.

@atk - You're technically right. It is possible they store the password in an encrypted form. But I'm trying to imagine a site that a) has the technical capability to do this, yet b) lacks the security skills to know why password hashing is much better (e.g. disgruntled employees can't un-hash a hashed password). The set that includes both conditions is very very small. Much smaller than the list of companies that store passwords in plaintext. So yep, it's possible, in the same way being struck by lightning while holding a winning lottery ticket is possible.

@Jason in my experience, it's quite common for engineers trying to do the right thing but completely misunderstanding proper use of crypto. Flaws like that are completely unsurprising.

@atk, fair point.

Guys, do you seriously think multi-billion dollar company would switch their internal policies, rebuild their IT infrastructure because someone on the interwebs thinks it's bad?