[zeugma]

A proper web firm doesn’t store its users’ passwords and therefore cannot give them out.

So I guess it's magic anytime you type in your password on a website and it just works huh?
 

No. It's not magic. It is a hash. If you are doing business with a company, and you forget your password, and their tech support line can actually give you your old password, run. Do not walk. Run away from them because they are absolutely violating very fundamental and elementary protocols. There is never a situation where they should be able to tell you what your password is.

This is pretty basic stuff, really.

[usconservative]

No. It's not magic. It is a hash.

And what do you think that hash is?

If you are doing business with a company, and you forget your password, and their tech support line can actually give you your old password, run. Do not walk. Run away from them because they are absolutely violating very fundamental and elementary protocols.

Couldn't agree more. My point is and remains, a hashed password is still a password. The original poster failed to understand that.

The value of that hashed password to the Fed's is zero unless they're also given the algorithm that was used to generate the hashed password.

Giving the Fed's hashed passwords isn't my concern - turning over the hash key algorithm's is.