3

I used to work for a company, where they have a team of moderators, who actively monitor which accounts are scammers etc. To monitor this they can find links between user accounts via a users password, so they are able to see all user passwords in plain text.

Is this breaking any law or is it more just morally run?

6
  • 6
    Please tell us which company this is. On a scale from horrible to worse, storing passwords hashed without a salt is horrible, storing passwords unencrypted is criminal, giving access to user passwords to staff deserves hanging management from the nearest lamp post (tied up by their feet obviously. Right above a bunch of hungry crocodiles). – gnasher729 May 5 at 11:21
  • The ability to “find links between users via their passwords” does not necessarily imply that they can read the passwords. They may be just comparing the hashes for equality. – RBarryYoung May 5 at 18:21
  • Well the GDPR is only applicable in the EU and as you don't state were you are we cannot assume that it is the law that you are bound to. So I'd say as long as you don't explicitly state that you don't store passwords as plaintext in your privacy policy it's fine. It is the users job to read that binding legal document and not accept it if there are any issues that he/she has with it not yours. Using closed software is a privilege given by the rights holder not a right. – Anonymous May 5 at 19:40
  • 1
    @RBarryYoung if they can compare the hashes they’re not salting the passwords so they are not using best practice. – Dale M May 5 at 22:11
  • 1
    @RBarryYoung I should say I know for definite they are showing the passwords to staff. For any new user who has signed up, their plain text password is automatically revealed to the moderators for a certain time period before it becomes hidden again. They basically store the unsalted hash in a table the hash can then be decrypted with a staff members private key. I've tried talking them out of it but they say it catches a lot of scammers, but it still doesn't sit right with me. – Tom May 10 at 15:19
10

The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “[t]aking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons” (c.f. Art 24, 25, 32 GDPR).

As of 2021, the state of the art for password storage is a special password hashing function such as Argon2, bcrypt, or scrypt.

However, the nature and context of processing could reasonably lead to the conclusion that the usual hashed password storage is not appropriate, for example because the ability to find links between user accounts is more important. There is a trade-off between different aspects of security, and the data controller could reasonably arrive at an unusual conclusion. However:

  • The data controller would still have to implement appropriate measures to protect these plaintext passwords, for example by storing them in an encrypted manner, keeping unforgeable access logs, and limiting access to plaintext passwords to specially trained staff. Encryption is one of the few things that are explicitly required whenever appropriate.

  • The data controller better have a good analysis that shows that this unusual approach to security is appropriate. Even if not explicitly required, an Art 35 data protection impact assessment could be useful. The data controller has the burden of proof to show that these processing activities are GDPR-compliant.

So is this data controller breaking the law or doing morally dubious stuff? Not necessarily! It is possible to find a scenario where they are doing the right thing. However, such a scenario is far-fetched and rather unlikely. Without further background, the most likely explanation is that the presented password handling scheme does not comply with GDPR.

3
  • 1
    You don't need the plaintext password to check whether users X and Y are the same person. You can just use an unsalted (or constant-salted) hash for that. Of course, salting is strongly preferred for security reasons, but an unsalted hash is much less of a security issue than no hashing at all. – Kevin May 5 at 18:29
  • 1
    @Kevin I agree that hashing vs plaintext is not a completely binary choice, and that there are different technologies with different security tradeoffs in between, for example I also mention (reversible) encryption in this answer. But my main point is that deviating from the state of the art should have a very good reason that properly balances different interests. Personally, I think it is unlikely that being able to tell whether two users share the same password could improve other aspects of security. There are also less intrusive means for such checks. – amon May 5 at 18:51
  • Perfect, this is the sort of answer I wanted. When I worked there we have locked down the viewing of plain-text passwords to just the moderation department and we don't store them in plain text in the DB just a hash in the DB but each of the staff members have specific keys to decrypt them. It still never sat right with me, as we're revealing a user's password (which could be used for other sites) without them knowing. – Tom May 10 at 15:24
2

GDPR regulations on the whole do not actually mention passwords (source: Information Commissioner's Office UK, this may vary in other country's implementation of GDPR) and providing that the data is only accessible by authorised parties within the organisation within the parameters set out in user agreements and/or privacy policies, then the law isn't broken.

That being said, if the passwords are stored in plain text then that's a security flaw and should the data be leaked, the entire user base would have grounds for a civil suit against the organisation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.