2 ms·
>...if they send you your password back in the clear in a password reminder email, rather than forcing you to create a new one. This only indicates they store
by zck 16y ago
>...if they send you your password back in the clear in a password reminder email, rather than forcing you to create a new one.
This only indicates they store the password in a recoverable format. It could be encrypted. It shouldn't be stored encrypted -- hashing is the way to go -- but it doesn't mean the server has "hunter2" sitting on disk somewhere.
- tptacek 16y agoIt is extremely annoying to make "recoverable" encryption schemes even nominally secure. Most of the time, anything that can mail your password might as well be storing the raw passwords. It's bad mojo to suggest that "reversable encryption" is a good strategy. Every time this comes up, someone suggests some rube goldberg contraption involving multiple hosts and escrowed keys which is hard to refute except that it never exists in the real world and, even if it did, would still only provide security that asymptotically approaches hashing.