Lessons in website security anti-patterns by Tesco
Hey Troy,
Thought you might be somewhat interested in this one. Remeber the cool guys over at <a href="http://www.realestate.com.au/" rel="nofollow">http://www.realestate.com.au/</a>  Just to refresh your memory..<p><a href="https://twitter.com/#!/realestate_au/status/22073191480430592" rel="nofollow">https://twitter.com/#!/realestate_au/status/2207319148043059...</a><p>Anyway, "we are aware of this issue and are working on it".<p>Click <a href="http://www.realestate.com.au/" rel="nofollow">http://www.realestate.com.au/</a> then "Register".<p>Then stand in utter amazement at their solution.<p>-------------------------------------------<p><i>Why do we need your email address?</i><p><pre><code>     *We send your password via email.*
     *Your email address is your log on.*
     *If you forget your password, we'll send you a new one.*</code></pre>
-------------------------------------------<p>This is hilarious. I can only assume that they took offence to you choosing a "strong version" password, so they decided, how can we fix this? I know, lets just pick the password for them.<p>So, their fix that they told you about, was to ensure that you can't pick a password at all, and they will still email you their "super strong version password"...<p>> Thank you for registering. Your password has been sent to username[at]gmail.com. It should arrive shortly.<p>12 seconds later.<p>Your password is: DTCNE<p>(In case people aren't aware, realestate.com.au is owned by HomeAway)