2

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins.

I was wondering if this should be viable for a professional company (Either the external website company or my internal one) to store plain text passwords? And if so are they prosecutable under any law regarding how they store passwords?

Sorry I am very unaware of the way passwords should be handled and the law regarding them Thanks in advance

closed as off-topic by Xander, Jens Erat, NULLZ, Rory Alsop Feb 28 '15 at 17:26

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    I'm voting to close this question as off-topic because it's requesting legal advice, which is best not obtained from Internet Armchair I-Am-Not-A-Lawyer-But-Let-Me-Advise-You-Anyway types which may leave you not only uninformed, but dangerously misinformed. Legal advice should be obtained from a qualified legal professional in the appropriate jurisdiction. – Xander Feb 28 '15 at 13:57
  • @Xander, I agree, the question as currently worded is not appropriate. But if you remove the 2nd sentence of the subject (Is this illegal..), it might be. The question might be better worded as "When is it appropriate to use plain text passwords, and what about displaying them to the user on a web page?" – TTT Feb 28 '15 at 14:50
  • @TTT True, but in that case, it becomes a duplicate, as that issue has been dealt with in numerous questions and answers on this site already. – Xander Feb 28 '15 at 15:47
0

Theres no law regarding passwords. Only law that exists applies to personal details, but a password is not a personal detail. Since the password is often selected by the end user, under EU law this will Count as consent too, so even if someone would enter personal details as their password, it would Count as consent.

Depending on what the password protects, there might be security standards that laws will recongnize, for example Credit card details are protected under PCI DSS, Health information are protected under HIPAA, and so on. There also EU laws mandating how personal details should be protected. Those might mandate that passwords should not be stored in any recoverable form.

However, its a bad practice to display passwords like this. However, depending on what the password protects, it might not matter anyways. One example is that all passwords are visible to a administrator, so a administrator can log in as any user. This might be a way to solve that some systems does not have "Takeover" capabilities where a admin can log in "as" any user.

Another way can be that the service being protected by the password, is also protected by any other means, like a firewall requiring a VPN dial-in Before allowing access to the protected service. And the password protection on this service are then not compatible with Single-sign on solutions or similiar, why the Company behind, simply show the password to login to This protected service, because even if the password do leak out, its useless to a attacker who do not possess the other means requiring to reach the protected service (like the VPN dial-in details, certificates and any OTP tokens).

If the passwords are to workstations in the Company in question, and those are physically protected (eg to reach the rooms where the workstations are located, a access card swipe is required anyways), then it wont matter if the passwords are shown anyways. You still need that access card to do any harm.

There also might be that this password does not protect anything valueable anyways, they just want a light protection on the web site to prevent general public access, but the information is still safe for the public to view, but if anyone hacks the website, no harm is done anyways. Example: Product manuals available to customers of the Product. If those leaks out, it wont matter anyways.

Do a judgement if the information on the internal website is sensitive, eg "What happens if any unauthorized indivual accesses this website", and act accordinly. If the information is sensitive enough, you might want to report this to some security responsibile or something.

0

It is certainly not illegal to store or display plain text passwords in general. There are some best practices that should be considered. For example, if the website is accessible over the internet then SSL should be used anytime you are displaying a password. Even for internal only sites this is still a good idea. If passwords are being displayed, that means they are begin stored somewhere and not hashed. Regardless of whether the passwords are stored in plain text or encrypted, this is bad practice if the passwords are created by the users. If they are not created by the user, it is possibly fine to do this.

I personally use the following rule on all of my websites:

All passwords should be hashed and non recoverable unless all of the following rules are met:

  1. The passwords must not be created by the user. (This is the most important.)
  2. The stuff the passwords are protecting should not be important. (Cannot be expensive or dangerous if the passwords are compromised.)
  3. It should be easy for the website owner/operator to change the passwords at a moments notice, and not have a drastic affect on anyone.
  4. The site uses ssl when displaying the passwords to the users.

In your case, if any of those rules are not being met, I would consider making a change. If #1 is not met, then I would definitely make a change, and ASAP. The last thing you want is someone to use the same password as their bank login, and to have that password compromised.

Not the answer you're looking for? Browse other questions tagged or ask your own question.