Site password being used to secure ZIP download, are they storing my password in plaintext?

Question

Recently a utility provider has started to attach a zip file including my bill inside, however, they have secured the zip file using my online web account password.

I am not too concerned about somebody getting my bill, however, it concerns me in two other ways...

First, would this now allow for easier dictionary attacks? If a malicious actor where to get a hold of the zip file, they could run a dictionary attack against it with no real knowledge right? Online they would be able to try and prevent this however when this media is downloaded there is no way to put in any preventatives.

Second, are they storing my password in plaintext (or another recoverable format)? It seems unlikely they would be able to use the same hash across both the site and the zip file they are sending out, right?

I use a unique long/secure password for this account, as well as a unique email, so I am not too worried about the issue affecting me personally.

Thanks ahead!

Answer 1

First, would this now allow for easier dictionary attacks? If a malicious actor where to get a hold of the zip file, they could run a dictionary attack against it with no real knowledge right?

Yes. They could perform an offline attack, with no limitation on number of attempts.

Second, are they storing my password in plaintext (or another recoverable format)?

Most likely, yes. They keep the password in plaintext around. At least from the point you enter it to log in up to the point you download the ZIP file, but probably it's stored plaintext in the database.

It seems unlikely they would be able to use the same hash across both the site and the zip file they are sending out, right?

In theory, it could be possible if the site and the ZIP use the same KDF. I don't think anybody in their right mind would do this. And even if that were the case, the ZIP files still contain your password hash and still allow an offline attack.

Answer 2

It depends.

If they use a standard ZIP format, they probably use the plain text password. We can imagine a special tool that ask for a password, hash it with the very same parameters (including salt) as the site does and use that as the key, but I know no public tools doint that.

Alternatively, they could keep the password in memory only for the duration of a session and encrypt the file during the session. That would allow to never store the password in plain disk on permanent storage.

In fact implementation details are hard to guess from only the public interface...