I don't understand why this keeps happening. When someone designs the user/password model for a website or software do they serious not even consider properly encrypting the passwords? This is not rocket science, implementing a relatively secure password hashing setup takes a minimal amount of work. Hell, adding a salt is an extra field in the database, an extra line of code when creating a user and an extra "+salt" when computing the hash.
I honestly think they spend more time coming up with ridiculous password requirements than actually encrypting the passwords. Possible dialog:
Dev 1: The passwords must have at least one symbol, one number, no dictionary words, and it can't be longer than 15 characters.
Dev 2: That'll be pretty secure, which hashing functions should we use? And should we salt it?
Dev 1: I think MD5 should be secure enough and salts are just overkill.
I honestly think they spend more time coming up with ridiculous password requirements than actually encrypting the passwords. Possible dialog:
Dev 1: The passwords must have at least one symbol, one number, no dictionary words, and it can't be longer than 15 characters.
Dev 2: That'll be pretty secure, which hashing functions should we use? And should we salt it?
Dev 1: I think MD5 should be secure enough and salts are just overkill.