Ever since I heard about programming, I was told that any password (especially the one used on login) should be stored in database using any kind of one-way hashing algorithm, and never ever as plain string. So, it can't be read directly from database, using any method.
Today I noticed that my bank (country department of Citi Group) is using my account (login) password to password-protect PDFs generated at the end of each month.
I'm curious: Are they breaching one of the most important security issue and are storing passwords in plain text in DB? Or is there any way to use hashed password from DB to password-protect generated PDF?
As far as my limited knowledge tells me, this isn't possible. And to use in PDF the same password as on login, it has to be actually read from DB upon PDF generation, which leads to a conclusion, that it is being stored there as plain text string.
This is a general question, on concepts of programming, not related to any particular language or technique, so I assume, it should be asked here, not in StackOverflow.