title: Why are plain text passwords bad, and how do I convince my boss that his treasured websites are in jeopardy?
body: <p>I've always been of the impression that storing passwords in a database as plain text is (as someone else here put it) a Very Bad Thing™. </p>
  
  <p>Historically, most of our server-side coding needs have been contracted out to a group of programmers. They store passwords in MySQL databases in plain text.</p>
  
  <p>As the resident code monkey (incidentally, the first server-side-savvy monkey to work here, so I'm inheriting the earth, so to speak) I have this pit of the stomach feeling that it's my bum that will be on the line when this plain text nonsense is exploited.</p>
  
  <p>I tried to explain to my boss how very very bad plain text passwords are, but it dawned on me: I don't think I've ever really know why they're so bad. Is there more to it than handing your hackers a list of passwords on a silver platter? That sounds bad enough for me, but in la-la land, where our websites are "secure" and impervious to any hacker, this argument doesn't seem to cut it. How can I convince (or scare) my boss into demanding hashing on his treasured websites?</p>
  
  <blockquote>
    <p>Related: <a href="https://stackoverflow.com/questions/287517/encrypting-hashing-plain-text-passwords-in-database">Encrypting/Hashing plain
    text passwords in
    database</a></p>
  </blockquote>