I really would have thought there'd be some sort of standard on dealing with secure info that developers strictly follow... at least a minimum that's expected.

Just came across the second developer that's storing email passwords clear in the database, no encryption whatsoever.

A couple of weeks ago I found that OnyakTech with its NukeA*lert and Axon modules had email passwords stored like this in the database with no protection whatsoever. I understand this was fixed recently though once it was pointed out to them.

I've now just discovered Catalook is in the same boat... with SMTP passwords for the store settings just stored openly in the table.

Is this sort of thing generally accepted?

I'm not really an experienced programmer or anything but taking a look at these tables I was surprised that I could so easily see passwords for all users and email accounts using any of these modules. Maybe it's normal to do this but if I need a developer to have access to DNN and SQL it most certainly doesn't mean I want them to have open access to all email accounts too!

Hi Sebastian

All points that do make perfect sense, and much as the guys at Catalook said.

For me it's not so much the malicious side but more to prevent the temptation when placed in front of people so easily... like locking cash in a box in an office as opposed to just floating in drawers - people are usually only bad when the temptation is too easy.

Something I just need to consider and start switching around email accounts and passwords as I don't want these so easy visible.

Cheers

Brandon, great news. IN addition, since many modules may save sensitive data as well (custom SMTP credentials, paypal merchant accounts), moduleSettings and tabmoduleSettings should be included as well.