When you change your password (or log in, for that matter), you also send the password in cleartext to the server. It doesn’t have to be that way, but almost all web logins work that way ATM.
So the extra exposure is the password in your e-mail in cleartext. This will be visible to the operators of the sending mail servers and to your e-mail provider. I hope you trust your e-mail provider to not read your e-mail. And OGS seems to send the e-mail via Amazon SES, which I’m sure processess e-mail that is way more sensitive than this.
So ideally a reset link could be safer, but in practice, it’s not clear what kind of exposure to worry about here.
I guess the worst part is the numerics-only password? If OGS generated a quite secure default password, then there wouldn’t be any practical worries with this, just a bit of a miss for best practices?
A danger that nobody has mentioned is that if you choose not to update your password after reset, anyone on the Internet can presumably lock you out by requesting another password reset, maybe even in the middle of a. Important game.
I certainly thought that, at least in most cases the transmission is encrypted.
Do you just mean “in a way that results in the server seeing the password”
, rather than “in cleartext to the server” ?
(I am aware of PAKE and that using it is very rare - if there even are
any sites that use it - but I had thought most use TLS, in which the
password is sent encrypted, although the server decrypts it on receipt.)
Yep, I meant to say that the cleartext password ends up in server memory, but it ended up sounding worse. Obviously it would be sent over TLS and be encrypted in transit.
I think a lot of SMTP is over TLS nowadays as well, so worth mentioning that the password in the e-mail is very very likely to be encrypted in transit as well (although it’s not quite as ubiquitous as https).