Essentially this is the deal.

The college I am at has all the passwords unsecured and unhashed in the HTML source.

Now can anyone give me the correct wording on why you should never do that? Besides the simple "Its unsecured".

Thanks.

"Because hackers can see the passwords and log into the accounts. Whats more most users have similar passwords, so you are failing to protect their privacy, so potentially you have a law suit in the waiting."

Give or take, that should be ok.

It's weird that you asked this questions. What more reasons or wordings need to be provided to stop this unsecure practice? Are you trying to convince someone in charge to not do that?

Originally Posted by yangyang

It's weird that you asked this questions. What more reasons or wordings need to be provided to stop this unsecure practice? Are you trying to convince someone in charge to not do that?

Sounds to me that is what's going on. As to why he would need another explanation.

I think my favourite quote comes into play here:
"Clients are idiots and think they can heard cats"

Unless you get multiple reasons from multiple sources saying essentially "Your wrong and it will costs money in the long term" they will never listen. Normally though, I tend to work on a "If you aren't going to listen, GFO" philosophy.