Ah yes, I was getting the various Keying options mixed up in my head:- http://en.wikipedia.org/wiki/Triple_DES#Keying_options http://en.wikipedia.org/wiki/Trip

Ah yes, I was getting the various Keying options mixed up in my head:- http://en.wikipedia.org/wiki/Triple_DES#Keying_options http://en.wikipedia.org/wiki/Triple_DES#Keying_options [EDIT] It does seem odd though that the passwords are encrypted and not hashed, but the hints are in plaintext. Why didn't they also encrypt the hints? (Rhetorical, the answer is probably just laziness/incompetence). Even if you do use bcrypt() or similar for hashing the passwords then encrypting the hints would prevent similar tactics being available from just a dump of the table contents.