[Hellcat]

Originally Posted by Nj?rd Eriksson

When you update the software, please consider to encrypt the email passwords that are stored in the database

This is a serious security concern.

Yes, that's something I want to implement ASAP.
However, since the passwords have to be accessible, there must be a decrypt function in the script - a hash would not work.
An admin who intentionally wants to get hold of the passwords could simply use the decrypt funtion to get them.

But during some chats on IM about this issue I got the following, I will definately build into one of the next updates (hopefully 1.0final):
Besides crypting login details in the database a user option to save the login details in a cookie on the local machine instead of saving them in the forum's database.

This (almost) eliminates the need to re-enter the login details everytime a user wants to use this, but also doesn't send it to anywhere else.
Only when the user uses another computer or the cookie gets deleted (on logout for instance) he has to re-enter the login details.

If the user trusts his admin(s) he can still let the login details be saved (in some way crypted to avoid "fly by" catching) in the forum's database to never have to enter them again.