Ask HN:Benefits Of Storing Passwords In Plain Text?
SwellJoe: I've been surprised by how poorly users in general deal with password resets rather than sending the password in plain text. Our website does password resets, and while it works reliably, and is roughly the same as any other password reset form (give it your username or email address, check email, click link; it's the standard Drupal password reset form, which is used by thousands of sites). Nonetheless, about once a week, I get an email from a user that can't figure it out; usually the reset email got filtered, but sometimes they just won't go through the form to reset their password...they'd rather send off an email to support@.I don't understand it, but it definitely happens.  So, maybe the folks who are choosing to save passwords in plain text are accepting the tradeoff in order to avoid having to answer as many support emails.We actually save plain text passwords within our management apps for a few circumstances; but not for emailing to users and never on world-facing web applications.  We offer the user the ability to use passwords in place of SSH keys for hooking up to managed systems in our cloud computing management product and in our cluster modules (though we generally recommend keys and SSL certificates); we also store MySQL passwords on behalf of users so they can manage their own databases from the control panel (this is akin to having MySQL passwords stored in configuration files for web apps, though it's a bit safer since only root can read them directly from the file system).  Our webmail client stores user passwords for authenticating to IMAP/POP3 services (much like Thunderbird or Outlook do, only we do it server-side).  So, it isn't "benefits" per se, in our case, it's that there's functionality that users want that can be done no other way.  They could be two-way hashed, but if an attacker has obtained root, they would have access to the key needed to decrypt the hashed passwords, anyway, so it seems pretty silly to pretend like something is encrypted if the attacks needed to be able to access the plain text would also grant access to the keys for decrypting.