Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? Not in a special honeypot scenario, but a standard business application.
Also, this implementation seems like a totally insecure obfuscation... is there a standard approach that would produce this output?
552A26043B56E619 - computer
752A26043B56E619 - Computer
5E2A3E072B - house
7E2A3E072B - House
The only time I've ever seen anything similar to this is in Dovecot (IMAP email server) where you can optionally configure it to log a hash of the password attempted for troubleshooting/debugging purposes.
However, even with Dovecot (which is an implementation I would trust more than what yours appears to be), it is only something I would enable temporarily for troubleshooting/debugging.
The reason is that a plain hash of a password is equally bad because you can perform brute-force attacks to guess the password.
There's a reason people use secure mechanisms such as PBKDF2 to hash passwords, and doing the sort of thing your software does (or leaving the Dovecot feature permanently enabled) essentially eradicates the whole point of the stronger hashing algorithms such as PBKDF2.
Therefore I would suggest you strongly ask the developers of your third party app to either remove the password logging function completely or introduce an option to disable it.
I can't see any security claims to the application to store the clients inputs. Also, the "ciphertext" seems to be reversible (instead of a hash). It's a bad practice.
