I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this government website sent my password to my email address in plain text.

I'm personally aware of how to handle user passwords, and I sent some comments about my concerns through a feedback form (this is a government website. People use other online gov. services which deal with sensitive information, as well as the fact that most people use the same password or handful of passwords for everything (I know I do) and I suspect the same security practices are used throughout) which I got a prompt response for. They simply reassured me that "the Ministry has taken the necessary steps to protect password information, including storing them with the proper encryptions in place."

I'd like to just say "well obviously you haven't taken the necessary steps if you're able to email my password to me" but I'm not trying to be rude, and I don't think my message would ever reach somebody who knows what I mean anyway.

So I'd like to just state that "the necessary steps haven't been taken according to [some official security standard]" which might prompt someone to look into it. I did a quick search on OWASP but only found an article regarding plaintext storage.

Is there a security standard regarding user password handling out there which prohibits (as I think it probably would) storage of retrievable password information? Even better: is there such a standard which must be followed by websites dealing with sensitive information such as banks and government web services?

I know I probably won't change anything but it's worth a shot IMO.

  • I got the same thing from VMWare about a year ago, but not because I had forgotten my password. I had just signed up, and knew the password I had just entered, and they emailed it back to me in plaintext. Thanks, I already knew that! Apr 18, 2011 at 23:04
  • lol that's awful. I wish people would stop doing that. Apr 18, 2011 at 23:49
  • What you're asking really depends on legislation in your country. We all know the best practice is to store a salted one way hash using a collision proof algorithm, however unless there's a law that spells this out, it really applies selectively. I suspect, however that you might be able to find something that looks 'official' if you dig through ISO regarding human resource management.
    – user131
    Apr 19, 2011 at 3:11
  • @Tim thanks, I guess I didn't think it would be dependent on the country. Apr 19, 2011 at 4:06

1 Answer 1


Well, the epic thread https://stackoverflow.com/questions/2283937/how-should-i-ethically-approach-user-password-storage-for-later-plaintext-retriev certainly has a lot to say about the issue.

Potentially relevant to your interests:

-1 passwords should never be "encrypted" It is a violation of CWE-257 cwe.mitre.org/data/definitions/257.html – Rook Feb 17 '10 at 21:52

  • I suppose you can encrypt them with a public/private key pair, as long as you make sure that the private key gets lost by accident :-)
    – gnasher729
    Jun 29, 2015 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.