Password inSecurity n Email!!

[nitins60]

I am using SMTP for sending emails of SMF (default function) as my host don't provide PHP mail support.

* use SMTP in admin area
* enable new user registration alert for admin
* in registration settings, disable Email Activation

now when new user register with wrong email address (not a valid one), administrator will get Email Sending Error report as a mail to his email address. In this email, you will see the SMTP email sending error and the email which is supposed to be send to recip!!

As SMF sends email to users with thier username and password, the administrator will get the username and password for wrong email address.

In terms of *Security*, it's a bit problem with SMF. It's not about Server Security, it's about Members Security. 

My suggestion is, don't send password to users in the Emails. Otherwise there must be another way to prevent it

[Kindred]

This is not a bug....   It is an opinion on correctly working functionality and a request to change that functionality/feature.

[nitins60]

*may be
hopefully dev recognize it

[SleePy]

It is not at all a bug.
This is done this way as you can leave the password blank on registration and one is automatically created for you randomly. So the user would need to know their password
I used to get those but I have set up my configuration to /dev/null all those mail returned unsuccessful sent to my main account and webmaster_email address in my SMF forums.

[Thantos]

I do agree that it is a security issue.  However, I believe that it falls under "acceptable risk".  Typically only one person is going to have access to those bounced emails and that person will generally be an admin who could change the user's password anyways.

[nitins60]

@Thantos, however knowing password is something different from changing password. Ofcourse admins are going to have access

[Smurfbutcher Bob]

Nitins,

The password hashes are trivially fetched by the admin. And from there, a lookup table would do the rest in mere moments.
Or, the admin can simply patch the login function in the php files with... one line of code, to note each user's password in the error logs as they pop in and/or register. No rainbows needed.

While I'd agree if the passwords were visible to anyone else (a moderator or whatnot), remember - you're dealing with the admin - and this person has full unfettered source access. There is *nothing* they cannot do.

Any attempt to deny or hide that fact is little more than "feel good" masturbation, and is grossly misleading to the users.  Forum passwords must be considered public, because the admin AND any successful attacker have full unfettered access to them at the source, "hash" or not. No exceptions. SMF is free to remove the functionality you describe... but I'm free to throw it right back in. And my SMF version will look exactly like yours - the users, who are told that SMF1.1.4 does NOT have that functionality, are screwed.

Or, users are told that the admin cannot be stopped from getting their passwords, so they should not re-use one that's used somewhere of merit.  That makes a little more sense, and is more correct.

Either way is fine, but the "security risk" argument is pure straw.