Skip to main content
added 187 characters in body; added 221 characters in body
Source Link
gnasher729
  • 2.7k
  • 14
  • 18

By definition, if a password is stored by someone other than you, then it is not stored securely. There is never any need to store your password.

If IT personnel ever have a legitimate reason to access your account without you providing the password, they don't need your password stored somewhere. They can do a password reset, access your account, replace your password with the original. All without ever knowing your password.

If they can send your password to you, then they can send it to someone pretending to be you. So it's not secure.

PS. They absolutely don't need to store the password for authentication. They can store a salted hash, from which recovering the password is impossible. That's the standard practice. How can they send it to someone pretending to be you? That's called social engineering. Someone calls, convinces them that it's you and that your email address has changed, and they send the password to the wrong person.

By definition, if a password is stored by someone other than you, then it is not stored securely. There is never any need to store your password.

If IT personnel ever have a legitimate reason to access your account without you providing the password, they don't need your password stored somewhere. They can do a password reset, access your account, replace your password with the original. All without ever knowing your password.

If they can send your password to you, then they can send it to someone pretending to be you. So it's not secure.

By definition, if a password is stored by someone other than you, then it is not stored securely. There is never any need to store your password.

If IT personnel ever have a legitimate reason to access your account without you providing the password, they don't need your password stored somewhere. They can do a password reset, access your account, replace your password with the original. All without ever knowing your password.

If they can send your password to you, then they can send it to someone pretending to be you. So it's not secure.

PS. They absolutely don't need to store the password for authentication. They can store a salted hash, from which recovering the password is impossible. That's the standard practice. How can they send it to someone pretending to be you? That's called social engineering. Someone calls, convinces them that it's you and that your email address has changed, and they send the password to the wrong person.

Source Link
gnasher729
  • 2.7k
  • 14
  • 18

By definition, if a password is stored by someone other than you, then it is not stored securely. There is never any need to store your password.

If IT personnel ever have a legitimate reason to access your account without you providing the password, they don't need your password stored somewhere. They can do a password reset, access your account, replace your password with the original. All without ever knowing your password.

If they can send your password to you, then they can send it to someone pretending to be you. So it's not secure.