Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this government website sent my password to my email address in plain text.

I'm personally aware of how to handle user passwords, and I sent some comments about my concerns through a feedback form (this is a government website. People use other online gov. services which deal with sensitive information, as well as the fact that most people use the same password or handful of passwords for everything (I know I do) and I suspect the same security practices are used throughout) which I got a prompt response for. They simply reassured me that "the Ministry has taken the necessary steps to protect password information, including storing them with the proper encryptions in place."

I'd like to just say "well obviously you haven't taken the necessary steps if you're able to email my password to me" but I'm not trying to be rude, and I don't think my message would ever reach somebody who knows what I mean anyway.

So I'd like to just state that "the necessary steps haven't been taken according to [some official security standard]" which might prompt someone to look into it. I did a quick search on OWASP but only found an article regarding plaintext storage.

Is there a security standard regarding user password handling out there which prohibits (as I think it probably would) storage of retrievable password information? Even better: is there such a standard which must be followed by websites dealing with sensitive information such as banks and government web services?

I know I probably won't change anything but it's worth a shot IMO.

share|improve this question
    
I got the same thing from VMWare about a year ago, but not because I had forgotten my password. I had just signed up, and knew the password I had just entered, and they emailed it back to me in plaintext. Thanks, I already knew that! –  thursdaysgeek Apr 18 '11 at 23:04
    
lol that's awful. I wish people would stop doing that. –  Carson Myers Apr 18 '11 at 23:49
    
What you're asking really depends on legislation in your country. We all know the best practice is to store a salted one way hash using a collision proof algorithm, however unless there's a law that spells this out, it really applies selectively. I suspect, however that you might be able to find something that looks 'official' if you dig through ISO regarding human resource management. –  Tim Post Apr 19 '11 at 3:11
    
@Tim thanks, I guess I didn't think it would be dependent on the country. –  Carson Myers Apr 19 '11 at 4:06

1 Answer 1

up vote 1 down vote accepted

Well, the epic thread http://stackoverflow.com/questions/2283937/how-should-i-ethically-approach-user-password-storage-for-later-plaintext-retriev certainly has a lot to say about the issue.

Potentially relevant to your interests:

-1 passwords should never be "encrypted" It is a violation of CWE-257 cwe.mitre.org/data/definitions/257.html – Rook Feb 17 '10 at 21:52

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.