In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security:
- Tesco - they store passwords in an "encrypted" format, yet they can decrypt the password and then email it to you when you click "I've forgotten my password"
- Plusnet - they store passwords again in some form of plain text/encrypted format but decrypt it and show it to you when you click "i've forgotten my password". Not as bad as Tesco, they don't send you the password by email, however they send a "recover password" link and on clicking that a browser window opens which shows your password in plain text (admittedly over a https connection).
My question is, what is the reason behind this? Both Tesco and Plusnet are storing customer's credit card details so surely security should be at the forefront of their mindset.
I want to know if I am wrong for believing that they are storing passwords insecurely. Will they have processes, policies and technologies in place which make this situation secure enough that the way they store their passwords is trivial?
Will they have special two way encryption that cannot be cracked by hackers? e.g. the same way that https, or API's work with a private key?
Will they have adequate security on their databases such that this will never be an issue, hackers will never get access to the data? (Judging by linkedin, sony and yahoo this is always going to be an issue!).
Or am I right in believing that it is wrong, and if so why? Are company's ignorant? i.e. they don't understand/know that what they're doing is wrong? Are they arrogant? i.e. they think that no-one will ever hack them? Or is it something else?