I forgot the password to a webmail account and they didn't have an automated password recovery process. So I had to chat with their support and they asked a few verification questions then proceeded to tell me my password.
If they know my password doesn't this mean one of two things?
The passwords are stored in clear text and they can just look them up or they have some kind of two-way hash and can decrypt the password. How else could they have known what my password was?
This is a large national ISP and it makes me very uncomfortable knowing they can look up my password whenever they want. Can someone confirm that this is a big security issue and they should not be doing this.
Thanks