Why would a website that resets your password to one of their choice be considered a plain text offender?

Because most users do not change their password after such a reset and mindlessly instruct their browser to save the new password and/or the site does not force users to change it after their first login.

Thus they effectivly send the new password in plain text, thus they are offenders.

A better way may be a One-Time-Token for a password reset, preferably sent via snail mail or SMS.


Email (SMTP/POP3/IMAP) is plaintext, so it's possible the password could be intercepted on the network or in storage by a third party.


The description in the About section of their page gives me the impression that the definition of Plain Text Offender depends solely on the storing of data:

A website storing a password in plain text means that your password is there, waiting for someone to come and take it. It doesn’t even matter if you’ve created the strongest possible password. It’s just there.

Whether it’s someone hacking into their servers, using a simple flaw in their site or even stealing their backups, over 30% of sites store plain text passwords.

We’re tired of websites abusing our trust and storing our passwords in plain text, exposing us to danger. Here we put websites we believe to be practicing this to shame.

(emphasis mine)

Reading this, it does sound like having a newly generated password emailed to you would not necessarily make the company a Plain Text Offender according to their definition. That is assuming they still STORE the password hashed (and hopefully salted).

I would however say that emailing a user their password is not ideal regardless, for reasons stated by SmokeDispenser and wireghoul.