Showing posts with label password-storage. Show all posts
Showing posts with label password-storage. Show all posts

Thursday, May 24, 2012

How should I ethically approach user password storage for later plaintext retrieval?


As I continue to build more and more websites and web applications I am often asked to store user's passwords in a way that they can be retrieved if/when the user has an issue (either to email a forgotten password link, walk them through over the phone, etc.) When I can I fight bitterly against this practice and I do a lot of ‘extra’ programming to make password resets and administrative assistance possible without storing their actual password.