France to Outlaw Hash Passwords

You know the extremely frustrating mash-up of letters and numbers you have to enter when you’re trying to log in to your online accounts?

While they may be annoying when asked to complete time after time, they actually do serve a function. When you “hash” a password, you’re turning it into a string of hexadecimal characters in a one way conversion. Meaning when you create a password on a site they hash it and store the hash. Then next time you log in, they hash the password you entered and compare that to information stored in the database. If the hashes match, you typed in the right password.

Hashing is good for security because it’s practically impossible to reverse engineer the hash to get the password. It’s a one way only encryption. That’s why most password resets don’t send you your old password. They don’t know it and can’t get it.

The French government has placed a law requiring a large group of e-commerce sites, video and music services and webmail providers to log its users’ information for one year, and must be handed over to authorities if and when asked. According to the BBC, this information includes “users’ full names, postal addresses, telephone numbers and passwords. Police, the fraud office, customs, tax and social security bodies will all have the right of access.”

This might be all well and good for the French, but over 20 international firms including eBay, Google, Facebook, and Dailymotion are in disagreement and involved in a legal challenge with the French Association of Internet Community Services (ASIC).

Let’s just hope this policy doesn’t become the norm in the U.S.