Use a unique password for PN

http://www.theregister.co.uk/2015/11/25/plusnet_stil...

I always use different passwords for each site - doesn't everybody

What's worse is that Plusnet's email servers still don't support SSL, so passwords are frequently sent across the internet unencrypted:

http://www.plus.net/images/support/email/setup/wlm20...

Probably no different to other ISPs - with pretty much all of the network authentication methods you must either have the plaintext password at the ISP, or transmit it in plaintext to the ISP.

What they really should do is have separate network authentication credentials to the one used for the portal and email - the network authentication is only of use to someone with the same ISP and can be easily traced, the portal credentials can be used from anywhere and gives access to personal information. Eclipse certainly separated the two when I was with them.

The portal credentials should never be disclosed by phone as it allows phishing and account hijacking - set a random new one and post the details to the registered address or alternate email address registered when the account was opened, force password change on first use. As ever this is typically seen as inconvenient when someone looses their password, and most people seem to favor convenience over security.

I assume sarcasm 'Doesn't everybody' but that is the problem. Hardly anybody uses a unique password at every site.

I do.

And when my wife was alive, if a site such as a credit card company needed us to have separate logins we used different passwords.

I don't, but I do use different passwords for important sites. Most importantly, never reuse your primary email address password as any compromised site using the same password would give hackers access to what is usually the primary channel for communication, getting passwords reset and so on. Having access to somebody's primary email address opens a potential Pandora's box.

In fact it's probably best to have a completely separate email account linked to "high security" sites like banks.

In reply to a post by TheEulerID:

In fact it's probably best to have a completely separate email account linked to "high security" sites like banks.

I give all my contacts a unique email address. It's a great way of reducing spam. If you get an email you shouldn't you know why and you can block that address without affecting any others.

Edited by Andrue (Thu 26-Nov-15 16:43:13)

In reply to a post by tdw42:

What they really should do is have separate network authentication credentials to the one used for the portal and email

My Plusnet email password is different to my portal/network authentication password (and always has been).

It's only the same when people don't take the short time required to configure it via http://email.plus.net

Separating the portal and network authentication credentials is overdue.

I admire your ability to keep track, although I suppose if you use a mail server allowing for an unlimited number of addresses you can just use a name based on the site DNS contents.