A favorite example from personal experience that boggles the mind and helps explain things: A core financial platform used by many many hundreds of financial i

A favorite example from personal experience that boggles the mind and helps explain things: A core financial platform used by many many hundreds of financial institutions in the US offers "encryption" of the online banking password, which is stored in the core DB. (Most of the times, the core system -- which records how much money you have, your txn history, &c -- is separate from other auxiliary functions like online banking, and the two are joined with some sort of gateway.) The encryption scheme was taking the password, and doing a byte-wise conversion to EBCDIC for that field. It was trivial to reverse with a one-line TCL query, but appeared encrypted to the casual observer. Brittle security theater, but probably allowed this company to hold their nose and mark off a "data secured at rest" checkbox somewhere. The encryption of the data transfered between teller workstations and the core was just as laughable -- XORed against a key sent to the client in plaintext at the beginning of the session. You didn't even need the key to break it -- using static strings or frequency analysis would suffice.