1

I think the risk of passwords being stored in plain text (or easily reversible encryption) is well known. I'm curious though how frequently does it actually happen? Has there been any study or reliable research on it's frequency?

For example of all the sites that have been compromised do we know how many compromised sites had plain text passwords being sold afterwards, as opposed to say a salted hash being sold?

Improve this question
8
  • 2
    I do it intentionally on a few of my casual non-sensitive sites. It's a convenience issue. I like to be able to send the user an e-mail with their password. Other account recovery methods have their own down-sides security-wise + some convenience issues. Most browsers also do this by default by remembering your passwords. (not clear text but reversible...) but maybe check here: plaintextoffenders.com (Not sure how common it is nowadays (in 2009, 30%) according to a link there)
    – browsermator
    Commented Jun 24 at 20:12
  • 5
    @browsermator Don't. The sites may be non-sensitive, but people re-use passwords, so the passwords are likely to be sensitive.
    – vidarlo
    Commented Jun 24 at 21:20
  • 4
    @browsermator: That's a really terrible idea. You certainly must never store the user's password reversibly without warning them beforehand. But even if warned, you will have users that reuse passwords between sensitive sites and your site. Now your storage technique is making their password reuse a million times more dangerous.
    – Ben Voigt
    Commented Jun 24 at 21:21
  • I have a very very small user base. In my case convenience outweighs security. If it gets to be a large set of users I'll re-do my "forgot my password" procedure. In the past I have checked all my users emails to see if they were on a breach list, and it was about 95% of them. (but not 100%, and some of the ones who weren't on the list were older than breached ones... so hopefully not from my DB) I'm guessing the percent is just very large for general public because of the huge breaches that have happened already.
    – browsermator
    Commented Jun 24 at 21:40
  • 2
    @browsermator the time/cost of properly implementing password storage and password reset functionality is minimal and can be done trivially by using existing/well-known frameworks.
    – multithr3at3d
    Commented Jun 25 at 0:00

1 Answer 1

Reset to default
1

There is a study on this from 2015: Half a Century of Practice: Who Is Still Storing Plaintext Passwords?

In industry, we find 11 such websites in Alexa’s top 500 websites list. Also, we find this is a universal problem, regardless of the profile of the websites according to our analysis of almost 3,000 analyzed sites.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .