Can you store password safe and still send it to your users in cleartext?

Here's an interesting article about password security: http://www.codinghorror.com/blog/2007/09/youre-probably-stor...

Even better is the linked article from matasano.com, but the link at codinghorror.com is broken. This should work: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...

To quote from that article: "We learned that the correct choice [to store passwords] is Bcrypt." (which is definitely one way)

Maybe they should. Maybe they don't need to.

My bank needs to encrypt may password because of their fiduciary duty to protect my money.

HN does not because the consequences of unauthorized access are relatively trivial and there is no duty.

In other words, passwords should be encrypted if it is a better alternative than not encrypting them and customer service concerns can easily outweigh any benefit encryption provides.

Which means that an attacker must: 1) obtain the encrypted PW from their database and 2) obtain the key to the encryption from their database.

But if the attacker obtains their database, it is likely that he/she obtains both the encrypted passwords and the key (or keys) to the encryption.

A real world analogy would be locking a document into a lockbox, then storing both the lockbox and the key to the lock on the lockbox, together in the same safe.

If someone cracks the safe, they have both the lockbox and the key, so the lockbox becomes ineffective.

It would, I suppose, be possible to salt and encrypt a password before storing it and thus be able to retrieve the original but you would have to be very sure that no 3rd party could get hold of your encryption key.