Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen?

If not required in the US, but required in the EU, can one legally do business in the EU without hashing passwords?

share|improve this question
    
The answers given suggest this is geography and domain specific. –  MikeNereson Nov 1 '11 at 17:05
    
"If not required in the US, but required in the EU, can one legally do business in the EU without hashing passwords?" IMO, one can legally have most businesses in any countries without passwords at all. I feel that this question is too vague to guess what it asks about and in which contexts. Hashing is an implementation detail (of something which was not even formulated in question). I shall be highly surprised if any laws would have stipulated technical details of implementation and realization of any principles –  Gennady Vanin Геннадий Ванин Nov 3 '11 at 11:06

5 Answers 5

It depends on what you are protecting. If it is personally sensitive info, credit card info or similar them you must protect it appropriately. Storing passwords in the clear would not be appropriate in these cases!

Credit card protection requirements are global (PCI-DSS), data protection laws exist in Europe, USA and other regions (eg DPA 1998 in UK)

Also, have a read of Thomas Pornin's blog post on this - Why passwords should be hashed - this will give a greater insight.

share|improve this answer
1  
You may be referring to: Gramm-Leach-Bliley Act protects personal financial information; Fair Credit Reporting Act protects credit history information; Health Insurance Portability and Accountability Act protects health information; Thanks. goo.gl/mQtLm –  MikeNereson Nov 1 '11 at 16:34
    
@MikeNereson - thanks for that. I know the UK ones, but am less familiar with the US. –  Rory Alsop Nov 1 '11 at 22:18

There is nothing in the laws on hashing passwords.

The only requirement is retention of passwords or data permitting to check or change them.

Update:
Hashing is an implementation detail (of something which was not even formulated in question).

I definitely shall be highly surprised if any law would have stipulated technical details of implementation and realization of any principles

Update2:
"Is there any legal reason to save a cleartext password?" here, on the same board, discusses the US FCC requirement to store passwords in clear text

share|improve this answer

I think it's required by different security/governance standard, like PCI, NIST, and SOX.

So you if you store your passwords in the clear you may not pass these certifications and as a results you may end up in court.

Aaron

share|improve this answer

Unless you have a very specific requirement to not hash them, hash them, it's simple and covers your behind if anything does happen where that data could be leaked. There are fairly simple implementations to make it take an unreasonable amount of time to crack a table of passwords, let alone a stupid amount of time to crack one.

Generally: you won't get in trouble for not hashing them, you will get in trouble if it gets leaked.

share|improve this answer
    
Compliance with certifications, standards and levels is not general requirement. The question is formulated in such a vague and elusive way, that answering to it is a guessing game –  Gennady Vanin Геннадий Ванин Nov 3 '11 at 11:04

If not required by law, are there legal ramifications if unhashed passwords are stolen?

That statement is something of an oxymoron.

IME (IANAL) almost every country has a legal concept of duty of care. So even in the absence of specific legislation regarding passwords, you are liable for management of all data you store. This does however move the issue from criminal to civil law (where such distinctions apply).

share|improve this answer
    
Not an oxymoron. I didn't ask "If not required by law, are there legal ramifications if passwords are not hashed" -- I asked about if they were stolen. But thanks for the insight on civil suits. –  MikeNereson Nov 2 '11 at 16:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.