How passwords and logins work: why a website should not know your password
Plain-text passwords: why a website should not keep your password as you typed it
You sign up on a website. Next week, the website must know that it is you again. The simplest way is to keep your password just as you typed it. Then anyone who sees the list sees your password.
-
1
Miva runs a small climbing gym, and her website lets members book a time on the wall. You sign up as a new member, with your email and a password: sunflower7.
-
2
A week later, you come back to book. You type your password, and the website lets you in only if it matches the one you chose. So it must have kept something on the day you signed up.
-
3
The simplest thing to keep is the password itself. Miva's list holds it just as you typed it, in plain text: anyone who opens the list can read it.
-
4
And many people can open a list. The person who fixes the website, an old backup copy, a thief who finds a way in. When a thief gets a copy, it is a data breach, and every password in the list is his at once.
-
5
It has happened for real, many times. In 2009, a thief copied the list of RockYou, a website of games and apps: 32 million passwords, all in plain text. The most common one was 123456.
-
6
Miva wants none of that for her gym. Yet next week, the website must still check your password. It has to check it without keeping it.
-
Go further
One more story worth a look.