3 ms·

> When we're talking about passwords "vaulted" in non-exposed systems used for customer support, I have a harder time getting upset about it. I don't like syste

> When we're talking about passwords "vaulted" in non-exposed systems used for customer support, I have a harder time getting upset about it. I don't like systems that work this way, but I see the support/security tradeoff and it's a valid one. Worth also knowing is that many ISP's store your password using reversible encryption, because if a customer calls up wanting to know their password, it doesn't have to be regenerated. Which can save a lot of time re-configuring modem PPP credentials with your average Joe.

sdkmvx 15y ago
If a customer calls up wanting to know their password, I would bet that they are configuring a new modem and that's why the need it. If their modem knows the password, why do they need to know it?
- trafficlight 15y ago
  Email, ftp access, ssh access. There are lots of other reasons for needing to know a password.
  - lurker19 15y ago
    I think elithrar was talking about the layer-2 modem password, not the layer-7 application user credentials.
    - rmc 15y ago
      What makes you think they are different?
dfox 15y ago
ISPs providing any kind of authenticated PPP store your password in cleartext, because PPP authentication does not work without storing cleartext passwords.
- tptacek 15y ago
  PAP doesn't require the server to store cleartext passwords.