Ask HN:Benefits Of Storing Passwords In Plain Text?
swombat: First of all, just because they email you your password doesn't mean they store it in plain text. It could be reversibly encrypted.Conversely, just because they email you a password reset link, doesn't mean they encrypt your password. It could still be stored in plain text."Development" doesn't exist in isolation. You can't look at just the "development benefits", you have to look at the "product benefits".The product benefit of storing a password with reversible encryption is obvious: a simplified "forgot password" feature. If your users are all hardcore geeks, that's not much use, but if you have many users who are not very tech-savvy, that can make a pretty big difference. After all, if a user can't figure out how to log on to the site because they are too confused to use the reset password link, you've lost that user - and for all you know, maybe that user is a 60-year-old director at a potentially huge client of yours, who then will decide not to bother with your product because he can't log in.The question you might also ask, perhaps, is whether there is a real security benefit to you if the site you're using does encrypt your password non-reversibly. Assuming that the people running the site are honest, the benefit there would be that if someone hacks into that provider, they won't get the password that you use for all your other accounts on the web.My answer to that would be: if you use the same password for multiple service, you have no business getting all uppity about password encryption policy, because the security failure is you. If you care about security, use a different password for each service (a tool like 1Password makes that process easy). If you don't use a different password for each service, don't complain about security. I wish more people would realise the inherent hypocrisy of complaining that "you should encrypt my password because I use the same password on many sites". Fewer sites would have to encrypt passwords to appease those users.