Recently I signed up for new account for a service provider's web site.
I entered the usual the name, email , password (strong) , repeat password and I was signed up. Great everything works well.
A few days later I had some trouble logging in, I did the 'forgot password' process and yet my new password (strong) did not work.
I contacted the system admin and during the conversation, he told me what my current password is. :o
I was shocked because he knows what my password is. Is it not best practice to hash passwords?
What if I am someone who uses the same password for all of my accounts? Now those accounts are compromised
I am wondering if there is a way to know when entering passwords in a sign up form , the database admin uses some form of hashing for any website and therefore cannot see the 'actual' password?
By knowing this I can refuse to sign up (possible phishing site to target amateurs) and/ or use a different password.