system
Given the following post, respond as if you're commenting on Reddit:
human
Poor password storage - can someone knowledgable weigh in?

I'm trying to deal with the owner of this random online business who refuses to delete my online account 'cuz of "IRS Regulations," and as far as I understand it, they're storing passwords in plain text (clicking "forgot password" just emails it to you). Here's our abbreviated conversation - **am I going crazy?**

Me: 

>Hello! I'd like to have my online account disabled and made inaccessible if at all possible. It seems that Iâ€™m still able to log onto the site and see order history, my home address, phone number, email address, name, card information, etc. Iâ€™m mostly concerned about hiding that information because it seems that your website stores login passwords unencrypted, so any breach of login information would expose all of it.

Him:

>IRS regulations require that we keep this information in our database.  You should no longer have on-line access.  Card information is NOT stored in our database, and passwords ARE encrypted.

(At this point I definitely still have access - he just changed the password to "Disabled1234")

Me:

>I'm concerned about encryption because your website is able to simply email me my password. If I understand correctly, that would mean that your website is storing passwords in plain text, which is definitely a poor security practice. You should definitely be looking into that, and make sure whoever's set up the website knows about this flaw.

Him:

>On a request for a password, the encrypted password is retrieved from the database, decrypted and sent via SSL email to the customer.

Me:

>I don't know much about encryption... but I'm pretty sure it's a one way street. As-in, unless you know the original key, the encrypted version should just be garbled data that can't be reversed. At least, that's how *passwords* are generally encrypted. That's why most websites won't ever "know" your password. Instead, they take the text you entered, pass it through a standard encryption algorithm (like SHA-256), and compare it to the hash in the database. If the algorithm is any good, it can't be easily reversed. That's the extent of what I know about encryption...

Him:

>We use SHA-256 to encrypt email passwords.  As we have the decryption KEY, when our PHP software RETRIEVES it from the database, it is available if needed to provide that password to the customer.  Any time you ENCRYPT information, you have to have a way to DECRYPT it.

If I understand correctly... he's just assuming that his database is encrypted because he has to have a password to log in to it... but the passwords inside *are* stored in plain text. Is that right?
gpt
Encryption is a 2-way street.  

Hashing is the 1-way street.

SHA-256 is a hashing algorithm.  So if the site was really using that then it would not be able to retrieve the password.

Encryption is not suitable for storing passwords.  Keys can be stolen as easily as the database.