[sigden]

What legitimate use case is there for implementing a 2-way encryption method over a hash function for passwords?

[paulhauggis]

I never said it was the best method to use over a hash function. However, it's much better than plain text and it would be unethical to say the company didn't have any security of the original poster doesn't know for sure.

[ryanlol]

Customer support. A human can then verify the user even if they can only remember a part of the password.

[stephenr]

Sounds like a security flaw ripe for social engineering

[ryanlol]

Customer support by itself tends to be a security flaw ripe for social engineering.

[stephenr]

Phone support can be tricky yes, but there are other ways to identify the caller without storing their password in plaintext

[ryanlol]

Callbacks? Users PII? There's really no good ways to do phone verification. You can't use any kind of shared secrets as people forget those.

[stephenr]

My bank uses an automated system to verify a pin (ie the operator transfers you to confirm identity then you come back)

But it also depends on the realm. Before the saas craze, a lot more support was performed in-house meaning you didn't have the same scale of problem.