October 01, 2004

First Day Of The Month: Least Secure?

I've come to dread the first day of any month. Why? Because it's the day my email inbox is full of emails that begin like this:

This is a reminder, sent out once a month, about your XYZ mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list.

The XYZ is the name of the mailing list. The part that freaks me out is that the way these emails always end:

Passwords for username@whatever-domain.com:

List                Password // URL
----                --------
emailaddr-for-list@whatever.com      thePasswordInPlainView     http://the.domain.for.the.mailing.list

As Homer Simpson would say, D'oh!

Whywhywhywhy do so many mailing list programs email you your password like this!? Every month, faithfully executed by the mailing list server program. Why, if I wanted to get a lot of passwords, I'd simply sniff packets for email on the first day of each month. Prolly wind up with millions of 'em.

This has got to be the most bone-headed "feature" of mailing lists. Every month I am surprised that tech-savvy companies, like for instance Technorati, use mailing list software that spews out passwords. Bad bad bad.

Posted by brian at October 1, 2004 06:20 AM

Comments

word. i always wondered about that too!

Posted by: a reader at October 1, 2004 10:11 AM

No, only ONE software does this: GNU Mailman. It is brain dead in a multitude of ways. And it is completely stupid to have these passwords at all. Most mailing list software doesn't use passwords, since it is clearly the wrong solution. Being able to receive mail at the address is enough authentication.

Posted by: Jonas at October 15, 2004 07:10 AM

Read More in the Archives:
April 2006 | March 2006 | February 2006 | January 2006 | December 2005 | November 2005 | October 2005 | September 2005 | August 2005 | July 2005 | June 2005 | May 2005 | April 2005 | March 2005 | February 2005 | January 2005 | December 2004 | November 2004 | October 2004 | September 2004 | August 2004 | July 2004 | June 2004 | May 2004 | April 2004 | March 2004 | February 2004 | January 2004 | December 2003 | November 2003 | October 2003 | September 2003 | August 2003 | July 2003 | June 2003 | May 2003 | April 2003 | March 2003 | February 2003 | January 2003 | December 2002 | November 2002 | October 2002 | September 2002 | August 2002 | July 2002 | June 2002 | May 2002 | April 2002 | March 2002 | February 2002 |

brianstorms is Brian Dear's weblog. Non-spam email:

Be sure to take a look at these other fine websites:

Copyright 2002-2003 Birdrock Ventures. brianstorms is a trademark of Birdrock Ventures.