Hacker News Reader

I mean that could still be encrypted. But passwords should never be reversible. It should be hashed with scrypt or apparently now Argon2id.

View on HN

I mean literally like if the person's password was "potato##!" the customer service person would read back "potato##!". They weren't reading the encrypted contents of a pw field.

their point is it could have been stored encrypted and then decrypted for the customer service person to read back to you. Access to plain text != storing it as plain text.

The only way three people can keep a secret is if two of them are dead.

If the data can be read by so many people in the company that even the customer service people have access, it's functionally not encrypted.

I don't disagree with you, however the original claim of

> provably storing peoples' online banking logins in plaintext in some ancient mainframe database system

Is not about functional encryption but storing directly as plain text.

That doesn’t mean that it is stored as plain text. It just means that it isn’t hashed.

I agree that it any system that allows this IS almost certainly just storing as plain text, and that it’s bad regardless.

Reply on news.ycombinator.com