Re:Ask HN: The correct way to email users their PLAINTEXT pa...
by brudgers on Monday January 16, 2012 @06:41PM
(#3473112)
>"I was pretty shocked to be honest when I was told that this site used plain text. I didn't think anyone did that"
Again, there may be a business case for doing so.
If my HN password is compromised, the consequences are relatively trivial. Therefore if HN spent a lot of time dealing with lost passwords, it might make economic sense to store them in plaintext.
If my Lloyds of London password is compromised, there are relatively significant consequences. Therefore, it should not be stored in plaintext.
In other words, ask your client about their needs and their operation and determine the appropriate way to store the password based on those things not your preconceptions.
Again, there may be a business case for doing so.
If my HN password is compromised, the consequences are relatively trivial. Therefore if HN spent a lot of time dealing with lost passwords, it might make economic sense to store them in plaintext.
If my Lloyds of London password is compromised, there are relatively significant consequences. Therefore, it should not be stored in plaintext.
In other words, ask your client about their needs and their operation and determine the appropriate way to store the password based on those things not your preconceptions.