Recently I answered a question where the password was sent to the users email in plain text. Technically this means the password is stored in two ways,
- Plain Text - which was sent to the user (the worst case)
- Encrypted text - which was decrypted and sent to the user (the best case)
Both of them are insecure, no arguments there. A company rep has told the user that the password is not stored in plain text. So I assumed the best case scenario in my answer that it is stored as encrypted text. I never said this was secure, the only thing that changed was the order of steps to be taken where I prioritized stoping email communication of passwords before hashing.
The answer received some highly up voted comments that I am wrong to blindly trust the rep. But is it right for us to blindly distrust the company rep?
Now to my actual question,
Should all the answers be written for the worst case scenarios (for ensuring max security or something)? Am I wrong to assume the best case scenario for my answer?