How do I give our security auditor the information he wants? (2011)
Well, if the auditor wants to play willy-measuring tactics: I&#x27;ve been using Unix since 1982 (Bell Labs Version 7, since you asked), and I rather suspect that I&#x27;ve more experience than he has.<p>UNIX and derived&#x2F;lookalike systems like Linux have _always_ stored passwords one-way encrypted. I have precisely no idea how he expects the sysadmin to provide a list of plaintext passwords, short of replacing the passwd utility with a hacked one that stores the pre-crypt version somewhere for retrieval, or asking staff to email their plaintext passwords to the poor sap he&#x27;s badgering.<p>Either way, a massive security breach. The whole point of one-way encryption is that there is no persistent trace left of the original plaintext password. This guy&#x27;s way of auditing security recalls the Spanish Inquisition&#x27;s way of auditing witchcraft. Damned if you do; damned if you don&#x27;t.<p>His company&#x27;s far better off using a payments provider with a clue - and a competent auditor.