[paulhauggis]

How do you know it's actually plain text? There are plenty of 2-way encryption methods out there.

Do you work there? If so, are you willing to lose your job over it?

These sorts of leaks can have devastating effects on the company/customers. You should also think about the employees that work there as well. Are you willing to risk their jobs in the event that the company loses money?

[dwelch2344]

I've spoken to a number of employees who have confirmed they are stored plain text.

I have considered those factors and am definitely concerned. However, consider the other side of the equation: a systems breach that leaves thousands (maybe even millions, given their size and 15 years of operation) of customers data being leaked, potentially leading to fraud and identity theft.

Who deserves to be protected? The organization that will not respond to the threat, or their innocent customers?

[dwelch2344]

Also, there is no good reason to use 2 way encryption on passwords anyways. It goes against every security best practice.

[sigden]

What legitimate use case is there for implementing a 2-way encryption method over a hash function for passwords?

[paulhauggis]

I never said it was the best method to use over a hash function. However, it's much better than plain text and it would be unethical to say the company didn't have any security of the original poster doesn't know for sure.

[ryanlol]

Customer support. A human can then verify the user even if they can only remember a part of the password.

[stephenr]

Sounds like a security flaw ripe for social engineering

[ryanlol]

Customer support by itself tends to be a security flaw ripe for social engineering.

[stephenr]

Phone support can be tricky yes, but there are other ways to identify the caller without storing their password in plaintext

[ryanlol]

Callbacks? Users PII? There's really no good ways to do phone verification. You can't use any kind of shared secrets as people forget those.