Quite a few managers and auditors really don't understand the difference between a password hash and a password.
I expect the auditor was asking for password hashes, although he was using the phrase "plaintext passwords". Who knows, but that part of the story may just be a wording misunderstanding.
Not everyone speaks geek, and it's important to know when you're talking to someone who does not ;)
Edit: Not sure why this is being down voted as it is a true statement. I've had to explain what a password hash is on several occasions. And even after that, there was still some misunderstanding/confusion.
You're being voted down (not by me, mind you) as it can be interpreted as a defense of the indefensible.
Even with the charitable interpretation of "this guy doesn't know what plaintext means", the overall conclusion "this guy doesn't know what he's doing and is downright dangerous" still stands.
The auditor specifically said "plaintext". He's clearly a moron, but there's no evidence that he somehow thinks plaintext and hashed are the same thing. He specifically said that the passwords should be stored in a "recoverable format for later use". He wants plaintext.
There's still the question of why he would need the password hashes. Assuming he wanted the plaintext passwords to see if they are 'complex' and 'strong,' he would have a hard time telling that from the hashes.
5f4dcc3b5aa765d61d8327deb882cf99 and 05b28d17a7b6e7024b6e5d8cc43a8bf7: Which is a dictionary word and which is a string of punctuation? (I didn't salt :))
John says the first one is "password", in under a second. I'll wait for a few hours to see if I can get the second one speedily. (By the way, this is why you shouldn't use MD5!)
You're right. I would never advocate using MD5. Use PBKDF2, bcrypt, etc! I just needed some hex strings to make my point about the hashes (hopefully) not being reversible to the actual password, and thus useless for the purposes of seeing if the passwords are 'strong.'
Define broken. It is possible to generate (within reasonable time) two files which have the same md5 sum, which means you shouldn't use it to sign anything somebody else have given you.
On the other hand collisions between two different files are still not something you would ever expect to see in the wild so if you are trying to find duplicated files, then you don't have to worry.
I expect the auditor was asking for password hashes, although he was using the phrase "plaintext passwords". Who knows, but that part of the story may just be a wording misunderstanding.
Not everyone speaks geek, and it's important to know when you're talking to someone who does not ;)
Edit: Not sure why this is being down voted as it is a true statement. I've had to explain what a password hash is on several occasions. And even after that, there was still some misunderstanding/confusion.