Contents
Is storing passwords in plain text illegal?
Today storing passwords safely should not be a problem, most languages have decent functions like PHP’s password_hash(). They procduce a string, which is as easy to store as the plaintext password. It’s not illegal to not hash the password although it would be very silly not to.
What are the concerns of storing passwords in plain text?
When a company stores passwords in plain text, anyone with the password database—or whatever other file the passwords are stored in—can read them. If a hacker gains access to the file, they can see all the passwords. Storing passwords in plain text is a terrible practice.
Why are companies still storing passwords in plain text?
Password hashing fundamentally transforms your password into a string of unintelligible text. Anyone looking at a hash would see gibberish. If you used “Password123”, hashing might change the data to “873kldk#49lkdfld#1.” A company should hash your password before storing it anywhere, that way it never has a record of your actual password.
How to protect personal information in the workplace?
Authentication 1 Control access to sensitive information by requiring that employees use “strong” passwords. 2 Explain to employees why it’s against company policy to share their passwords or post them near their workstations. 3 Use password-activated screen savers to lock employee computers after a period of inactivity.
What do you put at the end of a password?
Think of it like adding numbers and letters to the end of your regular password. Instead of using “Password” for your password, you might type “Password123” (please never use either of these passwords). Salting is a similar concept: before the system hashes your password, it adds extra text to it.
How to protect your company’s confidential information?
1 Tell employees about your company policies regarding keeping information secure and confidential. 2 Teach employees about the dangers of spear phishing—emails containing information that makes the emails look legitimate. 3 Warn employees about phone phishing.