nscs.org
Academic society
I received this unsolicited message. Apparently, my college sells student e-mails to these pseudo legitimate academic societies, and they just create an account for you that probably has all kinds of information about yourself already in it, with you ever requesting it.
They then generate a username and password and send this to you in an e-mail.
vps.me
VPS
Offers free and low-cost VPS plans, but it sends plain text passwords.
I’m getting off of your cloud right now!
autonomy.corporatecounsel.law.com
Corporate Counsel by HP Autonomy
Signup confirmation email
vaxjo.dexter-ist.com
Government system
Admission to child care, high school etc. This is what you get after clicked on forgot password in the login page. In addition, they also send your “personnummer”, social security number in field “Kontohavare” together with that. A very sensitive information in this context.
livetecs.com
Online time tracking
Immediately, upon registering an account, I received the above email with my login details (password in plain text). I’d just submitted them so it’s not as if I needed them anyway (even if it was acceptable to send them if a user forgot their password).
I’ve sent them an email with a link to this website so hopefully they’ll stop doing this in the future.
nfl.com
Sports league
Wanted to bid on an NFL football. After registering and entering my credit card information (which is stored), they sent me my password in plain text. I’ve contacted them about the issue, but doubt I’ll get anything more than some lip service. I can only hope that the same team didn’t also work on the credit card storage system.
creditkarma.com
Credit and financial management service
Reset your password? Sure, here you go!
goshow.co.il
Show tickets
I never opened an account with them, but now I have a password that I can not change(!) and they display my National ID back to me when I log in! At least they don’t save my credit card details on the site… I hope.
icmodus.com, icgrouplp.com
Interactive promotions
Editor’s Note: Turns out Subway doesn’t care about password security when it comes to third party suppliers either.
