Recommended Posts

Went to try and purchase the Battlefield Bad Company 2: Vietnam expansion that was on sale today from Direct 2 Drive. For whatever reason, they weren't able to process my order, so my friend decided to gift it to me instead. When I got the e-mail, imagine my surprise when I saw this:

ZOvSt.png

They E-Mailed me my account password in paintext! What does this mean? My username, password and any related information to that account are all stored in a database - unencrypted. :angry:

Shocking, especially given the amount of news compromised databases this year.

Link to comment
https://www.neowin.net/forum/topic/992392-really-direct-2-drive-really/
Share on other sites

That, my friend is ridiculous. I never really checked out D2D as I was never a huge PC gamer, but is there a reason you do not use Steam? I doubt Valve would allow this type of behavior.

I use and adore Steam. The expansion was on sale though, and I'm cheap (I bought BFBC2 when it was on sale through the EA store).

D2D being a store that deals with financial transactions, I had assumed that they'd be a little more responsible with my data though.

I would still say that the data will be encrypted, but it will be 2-way encryption, instead of doing what everyone else does and use a hash. Still, that's pretty apalling to email you your password. I have had websites do that to me as a "forgot your password" reminder, and it still makes me uneasy.

I would still say that the data will be encrypted, but it will be 2-way encryption, instead of doing what everyone else does and use a hash. Still, that's pretty apalling to email you your password. I have had websites do that to me as a "forgot your password" reminder, and it still makes me uneasy.

Well then, maybe I've over-reacted.

However, given that the e-mail was automated, wouldn't that suggest that the pass-phrase / function used to encrypt the password would be found somewhere in the source code? If an attacker were to gain access to the database, then they could also gain access to the back-end code as well.

Well then, maybe I've over-reacted.

However, given that the e-mail was automated, wouldn't that suggest that the pass-phrase / function used to encrypt the password would be found somewhere in the source code? If an attacker were to gain access to the database, then they could also gain access to the back-end code as well.

Actually I don't think you did. When the email was sent, it was still sent (most likely) over an insecure path, free for anyone to intercept along the way.

You should email / call about this. It may not make a difference, but still bring it to their attention.

Yup, opened a support ticket with them to let them know. Hopefully they'll be able to change this behavior.

Man, that's some short password you got there.

It's actually larger than that, I just botched up while doing the redaction. (Note the white space to the right of "You") ;)

It's odd that they'd send you your actual password like that. I wouldn't be too worried though. A lot of services send you a randomly generated password after requesting a new password. I don't think it's any different in terms of security.

It's odd that they'd send you your actual password like that. I wouldn't be too worried though. A lot of services send you a randomly generated password after requesting a new password. I don't think it's any different in terms of security.

They generate the random password, send it to you in an email, then hash it before it is put in the database. It's not retrievable in plain text after this point.

I Think that is suppose to be a temp password, it auto created an account for you so u can login. Whom ever sent you a gift, sent it to a email address that did not have an account.

Sadly, this isn't the case - it was actually my password that I had personally set for that account.

I would bet that more sites that not still haven't learned the benefits of hashing passwords sadly. I wonder too how many of those that have take the time to also salt the password hash.

I hate companies like that, when they send you emails with your ****ing password clear as day in the email.

They say **** like ... Login now with your password and the proceed to tell you in plain text what your ****ing password is. Idiots

Plenty of fish does the same thing

https://www.neowin.net/forum/topic/944688-online-security-at-its-best/

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • My father still uses a programme written in dbase3. Still manages to work with a little help from dosbox. 
    • Microsoft hides these secret Windows 11 performance boost settings available on every PC by Sayan Sen Windows enthusiasts often look for ways to extract as much performance out of their systems as possible, and it's often the case that they try and do so while trying to minimize the heat and power consumption. This is especially relevant in the case of mobile Windows PCs since laptops and notebooks tend to get hot and management of that heat and power is harder in such a form factor. As such users often turn to techniques like under-volting which can be used to squeeze out the maximum capabilities of a chip while also maintaining lowered power levels. There are official apps from AMD and Intel with the likes of Ryzen Master and XTU (Extreme Tuning Utility). While these are quite handy, most enthusiasts probably prefer to dig into the BIOS and play around with settings there like Curve Optimizer on Ryzen, which lets users set various frequency-voltage scaling values. These are essentially called P-States. If you are not familiar with them, Processor Power Management is done through Advanced Configuration and Power Interface (ACPI) P-states and C-states. While P-states or performance pwoer states handle CPU voltage-frequency scaling, C-states deal with CPU sleep states so that some of the CPU functions, which are not necessary at that moment, can be disabled. The P-states and C-states work together to make the processor run more efficiently. It helps the OS and apps determine which cores can be parked and which should be boosted. Of course not every user is an enthusiast or knows the technicalities and integrities of how things like overclocking or undervolting work. Thankfully for them Windows itself offers something pretty cool, though it is hidden by default on all systems. By default, Windows only has two P-States, "Minimum Processor State" and "Maximum Processor State." However, this can be changed with a Registry trick to expand the options under a secret "Processor performance boost mode" dropdown. This essentially enables the HWP or hardware P-States available on a device, and these are not controlled just by the OS itself as the underlying hardware gets involved too. In total there are five Processor Performance Boost Mode profiles that control how Windows requests and allows CPU turbo/boost behavior under the different power policies. They are: Disabled: In this mode, processor boosting is effectively turned off. The CPU will avoid entering turbo or boost frequencies and instead operate closer to its base frequency ceiling. This can significantly reduce power consumption and heat output, but at the cost of reduced burst performance and responsiveness in short workloads. Enabled: This is the standard behavior where boost functionality is allowed under normal conditions. The processor can opportunistically increase frequency when workload demands it, balancing performance gains with power and thermal constraints as managed by the system. Aggressive: Aggressive mode favors performance more heavily, allowing the CPU to enter higher boost states more readily and sustain them longer. This should in theory improve responsiveness under bursty or heavy workloads but increases power draw and thermal output compared to the default enabled behavior. Efficient Enabled: This mode still allows boosting, but with a stronger bias toward energy efficiency. The system attempts to use boost more selectively, avoiding unnecessary frequency spikes when the performance gain is marginal. Efficient Aggressive: This is a hybrid approach where boost is still performance-responsive, but the system continuously weighs efficiency more heavily than in Aggressive mode. It aims to deliver noticeable performance improvements while reducing wasted power in less demanding scenarios. Here's how to enable the Processor performance boost mode: Open Registry Editor: Press Win+R, type regedit, and click OK. Go to: HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\be337238-0d82-4146-a960-4f3749d470c7 (where HKLM stands for HKEY_LOCAL_MACHINE_) Modify the value of Attributes from 1 to 2 (you can find modify option by right-clicking) After that, exit Registry, you should now be able to see the new "Processor performance boost mode" dropdown menu: As you can see there are now five new P-States or CPPC states or power profile available that help define the boost mode processor setting on your PC. Wrapping it up here's a quick run-down of the settings as defined by Microsoft itself. Setting Description Disabled The corresponding P-state-based behaviour is disabled. Collaborative Processor Performance Control (CPPC) behaviour is disabled. Enabled The corresponding P-state-based behaviour is enabled. CPPC behaviour is Efficient Enabled. Aggressive The corresponding P-state-based behaviour is enabled. CPPC behaviour is Aggressive. Efficient Enabled The corresponding P-state-based behaviour is Efficient. CPPC behaviour is Efficient Enabled. Efficient Aggressive The corresponding P-state-based behaviour is Efficient. CPPC behaviour is Aggressive. Aggressive At Guaranteed Windows calculates the desired extra performance above the guaranteed performance level, and asks the processor to deliver that specific performance level. Efficient Aggressive At Guaranteed Windows always asks the processor to deliver the highest possible performance above the guaranteed performance level. In the next part we shall be comparing these settings to explore how much of a benefit or regression they can provide in terms of performance and power efficiency. If you decide to change the values on your system and are experiencing problems like crashes or an overheating PC, make sure to revert the steps back to the original state.
    • I think he means you haven't reviewed previous UFC games. Of course it doesn't matter... Every time you just report on something that involves the President even if just simply what happened you guys usually get accused of being anti-Trump. We live in fun times.
  • Recent Achievements

    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
    • One Month Later
      agatameier earned a badge
      One Month Later
    • Week One Done
      agatameier earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      518
    2. 2
      +Edouard
      198
    3. 3
      PsYcHoKiLLa
      147
    4. 4
      ATLien_0
      93
    5. 5
      Steven P.
      77
  • Tell a friend

    Love Neowin? Tell a friend!