Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email.
Couldn't they store their user's passwords in plaintext without the users knowing?
Is there any way for a user to detect/prevent this?
Of course they could, but then they could also just email themselves every time you change your password.
Now, depending on the type of system, there are plenty of regulations, audits, reviews, and processes that might be relevant to ensure that the developers don't do this, or many other types of malicious activity. However, you, as a consumer, usually do not have much insight into any of this - except for when it goes wrong, for example if they email you your original password when you ask to reset it.
But you're asking the wrong question here.
Yes, it is important that whatever systems you use are developed securely, but that will never remove the element of implicit trust you will always have in the system itself - and, in this context, the developers are equivalent to the system itself.
The real question you should be asking - and indeed you seem to be implying this - is how to protect your other accounts, on other systems, from a malicious developer or system.
The answer is simple, really - use a different password for each system.
Allow me to repeat that, for emphasis:
NEVER REUSE PASSWORDS ON DIFFERENT SYSTEMS.
Create a unique (strong, random, etc) password for each site, and never ever enter your password for SiteA on to SiteB.
Because as you intuitively noted, if SiteB has your password for SiteA in any form, then that password is no longer secure from SiteB.
Just for funsies, here is an xkcd on this:
One last note, if you're starting to worry "How in heck am I going to remember a strong password independently for each different site??!!?" - take a look at this question here on passphrases, and also look into password managers (e.g. Password Safe, Keepass, LastPass, 1Pass, etc).
You cannot know that someone will behave ethically or wisely, so:
I'm afraid that some developers aren't forward-thinking enough to understand the implications of an information leak for their users, so protect yourself rather than relying on others.
As others have said, you can't fully know what the developers are doing with your data once you hand it over. It may give you some confidence to examine how the site operates to see if they follow security best practices on the pieces of the system visible to you.
Checking these boxes doesn't guarantee they aren't doing something shady elsewhere, but it gives you a better sense of how the developers have setup the site.
As mentioned, avoiding password reuse is the most important security practice you can follow to protect yourself.
One way you can tell that they are able to get your password is if the forgotten password system is able to email you your old password. If it forces you to generate or set a new one then it's still possible that they have stored in plain text/2 way encryption though.
The other way you could tell is by signing up for a free hotmail account and signing up to a few (trusted) sites with the same password, see if anything happens.
Other than that, you can't really tell.
The only way how a website can prove it's NOT storing your password in plaintext is to never receive it in plaintext. This can be only achieved via client-side hashing script. Unless you can analyze website code and/or sniff traffic you have to assume that the admin has full knowledge of your password in plaintext.
See this question from an admin who wanted to give his users peace of mind you seek. it has many interesting answers, albeit most of them focus on security instead of proof-of-not-storing-plaintext.
