Why are plain text passwords bad, and how do I convince my boss that his treasured websites are in jeopardy?

Question

I\'ve always been of the impression that storing passwords in a database as plain text is (as someone else here put it) a Very Bad Thing™.

Historically, most of our

Answer 1

You may wish to point out that failure to properly secure the accounts could be exposing the company to legal liability if the information were ever compromised. Ignoring a known vulnerability could wind up costing you in legal fees if a user's data was exposed as a result of your company's actions (or inaction, as the case may be).

In the United States, there are certain types of data, such as financial and medical information, that companies are legally bound to keep secure and private. Failure to do so can have serious consequences. I'm not familiar with other countries' laws in this regard, but it's something worth looking into if your company is dealing with such data.

Answer 2

Plaintext passwords are not permitted if your organization maintains PCI-DSS compliance (e.g. a merchant who accepts credit cards). See PCI DSS item 8.4.

Plaintext passwords are not permitted if your organization is a financial institution that is insured by the FDIC (see FDIC FIL 69 2001).

Passwords should be encrypted both in transit and at rest, if you wish to achieve ISO/IEC 27001 certification, e.g. if you work with certain government agencies.

Answer 3

The two good answers I have seen promulgated for this question are:

1. You protect the passwords from snooping employees, i.e. people that have legitimate access to the database cannot easily steal a password should they feel so inclined,

2. A application logic flaw, such as an SQL injection one on a web site front end, will have a reduced chance of resulting in a compromise.

In my opinion it's a good idea to encrypt database password (although I'm yet to get around to doing it for most of my apps) but of far more importance is to make sure your database server is as bullet proof as possible with respect to network and authorised access. If an attacker can get to your database then it won't matter what how you've stored your passwords they will be able to break them.