Given the Sony data breach and other events recently, is there any actual laws or regulation regarding how to store passwords? I think there are with credit cards, you're not allowed to store the 3 digit key or something.Is it illegal to actually store plaintext passwords without warning the user? Or it there a level of encryption that has to be used?Are there any standard guidelines that anyone can point me to?
Is there any legislation requiring how we store passwords?
passwords;law;privacy
Regarding the storage of payment card data, what you're looking for seems to be called the Payment Card Industry Data Security Standards or PCI DSS.According to Wikipedia:The standard applies to all organisations that hold, process, or exchange cardholder information from any card branded with the logo of one of the card brands.Unfortunately I don't know of any regulations for storing user passwords.  Here is what I've heard is good practice, but I know it's probably not enforced:Use a library - don't try to write good encryption/hashing code yourselfDon't store the password, store a hash (bcrypt seems to be good as of this date)Generate a unique salt for each user, and concatenate the password with the salt before hashing.  This reduces the risk of rainbow table attacks.Don't keep passwords in memory any longer than you have to.  Use framework tools like SecureString in .NET to help manage the security of plain text passwords while in memory.Don't display passwords on the screen (both to avoid over-the-shoulder and EMI-based attacks)Don't allow passwords to pass across public networks in plain text (the FTP and Telnet protocols are infamous for this).  Use SSL/SSH/HTTPS to secure your connection first.Require passwords with some minimum complexity.  Don't limit the complexity! 