Many sites claim they aren't capable of viewing subscribers' passwords. How does this work? Is it mandatory?

Question

Many sites claim they aren’t capable of viewing subscribers’ passwords. How does this work? Is it mandatory for websites which allow users to log in? Are there any protocols or laws which obliged them to store passwords in such a manner?

Also, how is this possible? Do they storing the users’ passwords on their servers in an encrypted format?

Answer 1

All responsible companies should be hashing (the process to do what you are describing) passwords correctly (it is easy to do wrong); it is up to you whether you trust their claims.

There are laws about companies saying they do something and lying about it, but if they don't say whether or not they hash passwords, they are not forced to do it in the US unless it is covered by other laws such as PCI DSS or HIPPA compliance.

Answer 2

When you insert a password and click on a "submit" button, the website you are sending the form to gets the password in plain text. There is no way around it, this is how HTML works. It is not an absolute necessity, as there are alternative systems, but they are not implemented in HTML or in browsers today as far as I know.

That said,

1. the website seeing the password is not always the same site you are logging in to -- for instance, the Stack Exchange Network uses OpenID, which is essentially a way to delegate authentication to other "providers" such as Google or Facebook. In this case, your chosen OpenID provider (e.g. Google) sees your password and Stack Exchange doesn't.

2. This happens at the moment of the login; responsible websites will compute a hash and then discard the password immediately. A hash is a sort of encrypted version of the password from which even they cannot recover the original in a successive moment after you have logged in. In other words, they store a certain function f(p) of the password; when you wish to log in again, they can read your new password q and check if f(p)==f(q), but they cannot get back p from f(p) (or, at least, it is considered a computationally unfeasible problem to do so).
   Whenever a website sends your password back to you in plain text, for instance in an e-mail, it's a big red flag that they are not handling security responsibly. As a user, though, in general you have no way to tell if they are throwing away immediately the plain-text passwords or keeping them, unless something like this happens.

3. The method to keep you logged in a website relies on cookies and does not need storing your plain-text password anywhere.

4. As you can infer from our answers, password authentication is problematic in many ways, so you should never reuse passwords. The best practice is relying on a password manager, where your random-generated passwords are protected by a "master password" that never leaves your computer.