Gammae/Fame Dollars showing me my password over http
 

It's 2018, please - can affiliate programs start to tighten up their security? Why do you have my plaintext password stored anywhere? Why can I not access your website via https?

https://i.imgur.com/LLijtOH.png

Crazy.

And I just realized they truncated my password to 16 characters... =/

If you saw your password right after you signed up, it doesn't mean your password isn't hashed and stored.
Maybe be just showing $_POST data.

Try the forgot password function. If your password is emailed to you it's stored plaintext. If it's reset to something else it suggests they most likely are only storing a hash.

When I tried last time, the old pass was emailed with "forgot password". And it was truncated.

So the OP is right I believe :-(

- they store plaintext passes
- truncate them, not allowing proper password strength
- use plain HTTP, no encryption

It was emailed to me as well, but even if it's hashed and stored, it's being served over http. I don't like that.

It's not like I reuse passwords, but lax security here suggests lax security elsewhere.

Thanks for pointing out the issues that we have with the cash program. While we have already moved our paysites over to an https model, we are currently in the process of finding a solution to improve the security and user-experience of our cash programs as well.

As soon as we launch improvements, we will make sure to let our affiliates know

Bump for business :thumbsup