Storing Password in Databases in plain text vs Customer Needs
database, passwords
Solution
Write a short, clear and jargon-free formal letter stating your concerns and concluding that in your professional opinion, it should be rectified. Address it to someone reasonably high up in the customer.
If they then choose to ignore your advice, that's their prerogative.
(Keep a copy of the letter yourself, too.)
Problem
I want to call "storing a password in plain text in a Database" a bad pratice... but our customer did this in his Application. They want me to renew that Application. My point: I want to change this...but since it is not a need for our Customer it is still unclear. How do you handle such issues regarding security? From my point of view it is difficult to explain such issues to Customers.
Related problems
- Is it ever ok to store password in plain text in a php variable or php constant?
- Salting Your Password: Best Practices?
- How to best store user information and user login and password
- What is the best way to keep passwords configurable, without having them too easily available to the casual human reader?