Re:TMobile confirms they store passwords in plaintext, don't...
by Kalium on Friday April 06, 2018 @07:50PM
(#16778516)
Long story short, an encrypted password can be decrypted. There is no reasonable scenario here under which this is preferable to a non-decryptable hash. This creates a scenario where the only possible outcomes that are added involve security breaches of password texts.
Re:TMobile confirms they store passwords in plaintext, don't...
by gregatragenet3 on Friday April 06, 2018 @07:04PM
(#16778260)
Presumably the application that accesses encrypted passwords in the database also has the decryption key close at hand. So if that application is compromised the attacker has access to both the encrypted data and the key to decrypt it. If the password is just stored hashed there is no way to directly decrypt it, you can only verify that a clear text string matches the hash. I'm not sure how relevant it is these days, it seems like there's enough CPU / GPU power that any password that's short enough to be practical can probably be cracked from it's hash quickly.
Re:TMobile confirms they store passwords in plaintext, don't...
by GuthL on Friday April 06, 2018 @06:00PM
(#16777844)
Because they do not need it for the task at hand. Password security has clear best practices which are also simpler to implement than encryption. The very fact that someone can somehow read your password is a breach of privacy.
Re:TMobile confirms they store passwords in plaintext, don't...
by tejasmanohar on Saturday April 07, 2018 @07:23AM
(#16780298)
People reuse passwords. The mere possibility of someone being able to see it is bad.
I understand though that no one being able to know the password except the user is utmost security, but why not encrypting it ?