Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

12
  • 5
    Just for perspective, a security breach is only a potential loss of revenue, whereas fraud is actual loss of revenue. If your business is losing, say, hundreds of thousands of dollars a month due to fraud, management may be willing to take risks to stem that loss. Commented Jul 31, 2012 at 18:47
  • I don't think people give a damn. Otherwise password storage criteria would be outlined in EULA. But yes, comparing hashes is the same thing as comparing real source data, it can even be faster. Minus few theoretically possible collisions. Commented Aug 1, 2012 at 19:38
  • 3
    @nohat The simplification of this issue down to concerns of revenue stream seems really crass and unprofessional to me. When you store your users' passwords in plaintext, you are not just putting your company's reputation (and revenue stream) at risk, you are putting your users' security at risk, too. If you care so little about your users that you are willing to risk their security on behalf of your own revenue stream, you should be ashamed of yourself. Commented Aug 1, 2012 at 22:16
  • 3
    @nohat Well I do happen to believe that morals come into play when talking about professionalism. And I also happen to believe that your professional responsibility extends not just to management ("I was just following orders") but also to the customers. Commented Aug 2, 2012 at 16:52
  • 2
    No business needs to store plaintext passwords. There are always other options. Sorry to be a Sith about it, but if you are presenting to management, why would you even present an option to them that is unnecessarily insecure? How do you expect to catch anyone anyway? Everyone uses the same 150 passwords anyway, so your possibility of false collision is very high; just go look through a passwords list. Commented Aug 2, 2012 at 19:18