Am I required to hash passwords

Question

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen?

If not required in the US, but required in the EU, can one legally do business in the EU without hashing passwords?

Answer 1

I think it's required by different security/governance standard, like PCI, NIST, and SOX.

So you if you store your passwords in the clear you may not pass these certifications and as a results you may end up in court.

Aaron

Answer 2

Unless you have a very specific requirement to not hash them, hash them, it's simple and covers your behind if anything does happen where that data could be leaked. There are fairly simple implementations to make it take an unreasonable amount of time to crack a table of passwords, let alone a stupid amount of time to crack one.

Generally: you won't get in trouble for not hashing them, you will get in trouble if it gets leaked.

Answer 3

It depends on what you are protecting. If it is personally sensitive info, credit card info or similar them you must protect it appropriately. Storing passwords in the clear would not be appropriate in these cases!

Credit card protection requirements are global (PCI-DSS), data protection laws exist in Europe, USA and other regions (eg DPA 1998 in UK)

Also, have a read of Thomas Pornin's blog post on this - Why passwords should be hashed - this will give a greater insight.

Answer 4

If not required by law, are there legal ramifications if unhashed passwords are stolen?

That statement is something of an oxymoron.

IME (IANAL) almost every country has a legal concept of duty of care. So even in the absence of specific legislation regarding passwords, you are liable for management of all data you store. This does however move the issue from criminal to civil law (where such distinctions apply).

Answer 5

There is nothing in the laws on hashing passwords.

The only requirement is retention of passwords or data permitting to check or change them.

Update:
Hashing is an implementation detail (of something which was not even formulated in question).

I definitely shall be highly surprised if any law would have stipulated technical details of implementation and realization of any principles

Update2:
"Is there any legal reason to save a cleartext password?" here, on the same board, discusses the US FCC requirement to store passwords in clear text