4
votes

Is it legal (US and EU) to store user passwords in clear text (i.e. of a website)? Is there any law about how passwords should be stored?

I have a client that wishes to have passwords stored in the clear so a user can recover their password when they have forgotten, that I wish to discourage.

I am trying to convince my client that storing passwords in the clear is a very bad practice.

Please provide links to any laws, policies, or standards that I can use to help convince them.

9
  • 4
    Please reconsider posting legal questions on a forum that was meant for solving technical issues. It is fairly clear that (a) the legal community hasn't got clue one about technology, and thus, makes rather uneducated decisions about how it should be used vis-a-vis legal rulings on a consistent basis, and (b) none of us are lawyers/barristers/insert-whatever-title-is-appropriate, so none of use are capable of giving expert legal advice. Nov 23, 2009 at 20:51
  • Also see: meta.stackexchange.com/questions/17509/…
    – Troggy
    Nov 23, 2009 at 20:54
  • This question might help as well stackoverflow.com/questions/613396/…
    – Zoredache
    Nov 23, 2009 at 20:57
  • thank you. i've just read both, sorry if this was off topic, i think that, at least, it "has much to do with actual computers" =)
    – gpilotino
    Nov 23, 2009 at 21:03
  • You should consider updating your question with the details you have provided in the comments below. Perhaps say something along the lines of 'how do I convince my client to not be an idiot and store passwords in the clear'. Your issue may be related to system administration, but the current wording of your question doesn't really do a good job of conveying that.
    – Zoredache
    Nov 23, 2009 at 21:36

8 Answers 8

4
votes

I don't think you will find any one all encompassing law that applies everywhere, and I don't think you will find anything that describes specifically how to store a password.

There are a large number of standards related to security issues particular fields and types of services. Most of these standards include some information about how authentication credentials are supposed to be stored and kept secure. Failure to follow these standards can lead to legal problems.

4
votes

The prime directive in the EU is known as the "Data Protection Directive". Member states implement their own laws that are expected to be consistent with the directive. It is similar to the PCI standard in that it is vague and verbose. However, there are seven general principles that are mostly common sense. The one that may be of interest to you is #4:

Security—collected data should be kept secure from any potential abuses;

And Article 17:

Article 17 - Security of processing

  1. "Member States shall provide that the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

"Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected." ... (remainder elided).

http://en.wikipedia.org/wiki/Data_Protection_Directive

EU site: (good luck navigating this)

http://ec.europa.eu/justice_home/fsj/privacy/index_en.htm

I don't think the practice of storing passwords in clear text would be acceptable in the EU, because: implementing a password hash is trivial and does not increase costs; this is contrary to generally-accepted security best practices; and it would almost certainly fail an external audit, as there is the potential for abuse if the passwords were disclosed, and you have no way of validating the person using the password is who they claim to be (i.e., you only use passwords for authentication and no second factor).

To facilitate commerce, the US and the EU have a "safe harbor" agreement, that allows US companies to collect data from EU citizens, as long as they "self-certify" with the US Department of Commerce that it complies with seven principles.

The EU-US Safe Harbor Does Not Protect US Companies with Unsafe Privacy Practices:

http://writ.news.findlaw.com/ramasastry/20091117.html

0
3
votes

IANAL, but I don't think there is any law saying you have to. It could also vary a lot depending on what type of data it is. It is very poor practice and a security risk.

Be very careful with legal questions on these sites. You have no idea who really knows law and not. With any major issues depending on your organization, you should consult a real lawyer concerning these issues.

2
votes

I've just finished reading IDC White Paper which had some interesting viewpoints on user detail storage within the EU.

1
  • thank you, i'll look at how the "european data protection directive" is transposed in the specific countries
    – gpilotino
    Nov 23, 2009 at 21:07
2
votes

What you can and can't do with employee's data varies from state to state in the US. For instance CMR 17 in Massachusetts puts a bunch of constraints on how you handle employee data. This law was put in place to help reduce ID theft.

The problem with passwords, especially when dealing with people who don't know or care to know much about security, is that they will often use the same password for all their accounts. So any publication or leak of those could put those people or the business at risk.

1
vote

In the US:

Yes, depending on what line of business the client is in, there may be a law. Any client that deals with (these are just examples, by no means is this a complete list) online payment processing, credit card information, health/medical information, insurance, banking/stocks/trading, etc. probably has laws that cover storage and access of client/customer/patient information, and therefore the passwords that protect that information.

because seomtimes i've to discourage clients who don't care about security

Without sounding too harsh, this sounds like very bad security practice, very bad SA practice, and downright unethical. If you're not familiar with it, please read the System Administrators' Code of Ethics. Why you'd go out of your way to ensure that a client's data is compromised - especially when they're your client, I don't understand.

I've spent many late nights - at both my day job and working for clients - fixing security issues, without overtime, just because it was my machine or my client, and therefore my responsibility to ensure that everything is secure.

1
  • 1
    I think you have misread the OPs intention. It sound like he wants his clients to make good decisions. It sounds like he is looking for ammunition to help convince them that storing passwords in the clear is bad.
    – Zoredache
    Nov 23, 2009 at 22:36
1
vote

how do I convince my client to not be an idiot and store passwords in the clear:

  1. ask him if he wants to help criminals.
  2. ask him if he uses a different password on each website.
  3. ask him for his password of this bank account.
  4. If he doesn't give it, ask him why.
  5. explain to him that he might endanger the bank accounts of all of his clients if he stores passwords in plaintext, when a data leak happens and he will be financially responsible due to gross negligence.

Also, simply refuse to do anything with plaintext passwords, and offer them alternatives.

(IANAL)

0
votes

When asking for legal advice, you'll want to ask someone qualified to give legal advice (which is likely no-one on this forum). So... I'll ask the security geek question: Why the heck would you want to do that? That is just asking for trouble.

9
  • because sometimes i've to discourage clients who don't care about security
    – gpilotino
    Nov 23, 2009 at 20:44
  • Aaaah, gotcha. You're doing the opposite of what I assumed... looking for justification to NOT have clear text passwords rather than justification for doing so. Most authentication providers/applications have built in functionality to encrypt user passwords out of the box by default. Do your clients have any sort of business justification for why they would want to go out of their way to store passwords in a way that will leave them on the evening news due to a security breach?
    – Sean Earp
    Nov 23, 2009 at 21:01
  • sure, they want the user able to recover the old password :D
    – gpilotino
    Nov 23, 2009 at 21:05
  • Aaaah... gotcha. Tell your client that they do not want password recovery functionality (which is a bad idea), they want password RESET functionality which solves the business problem of allowing users into the system that have forgotten their password, but does not carry the security risks of plaintext passwords. Again, most common authentication providers/applications should have this functionality out of the box.
    – Sean Earp
    Nov 23, 2009 at 21:10
  • Apparently I start all posts with Aaaah... gotcha. Good times ;)
    – Sean Earp
    Nov 23, 2009 at 21:11

Not the answer you're looking for? Browse other questions tagged .