Subject: [OAUTH-WG] List security issue

From: hank williams <[email-masked]>
Date: Tue, 6 Jul 2010 06:05:15 -0400

I just noticed that every month the list administration system sends out an
email that includes the password to my account on this system. Obviously
this is a huge security issue. I am a member of around fifteen lists and
this is the only one that does this. I hope it can be resolved.

Thanks.
Hank

-- 
blog: whydoeseverythingsuck.com

---

From: Laurens Van Houtven <[email-masked]>
Date: Tue, 6 Jul 2010 13:09:54 +0200

Um, this is reasonably common Mailman behavior (admittedly less common
than the alternative), and the signup page warns you about it:

You may enter a privacy password below. This provides only mild
security, but should prevent others from messing with your
subscription. Do not use a valuable password as it will occasionally
be emailed back to you in cleartext.

If this irks you, you can choose a random key so the password is
useless for everything besides that list. There would be no escalation
of privilege, since anyone accessing your email can already set
*everything* related to the [email-masked] mailing list.

Cheers,
Laurens