Which practice is a common pitfall in password storage?

• A. Using salted hashes with bcrypt
• B. Rotating encryption keys frequently
• C. Storing passwords in plaintext
• D. Employing adaptive hashing functions like Argon2

Answer: (C)

Storing passwords in plaintext is a fundamental pitfall because it leaves the actual passwords exposed as soon as the data store is accessed. If the database is breached, attackers get immediate, readable credentials for every user, which can be used to log into other sites where users reuse passwords. There’s no barrier to offline guessing or credential stuffing when passwords aren’t protected.

The correct approach is to transform passwords with salted hashes using adaptive hashing functions like bcrypt or Argon2. Salting adds a unique value to each password before hashing, so identical passwords don’t yield identical hashes. Adaptive hashing makes each guess computation deliberately slow, which dramatically increases the work for an attacker trying many guesses, making breaches far less practical.

Rotating encryption keys isn’t the primary concern here because password storage relies on hashing, not encryption of the password data itself. While encryption can protect data at rest, it doesn’t inherently guard against offline attacks if the data is decrypted for use, whereas hashed, salted passwords stay protected even if the database is compromised.