Although highly suspect and troubling, this does not necessarily require that they have all users original passwords stored in plain text. If they had originally used a hashing function that obeyed the following:
Hash(pw) + Hash(pw) := Hash(pw + pw)
(NB: Where '+' above is really just a stand-in for any pair of combining functions, not necessarily arithmetic addition or string concatenation.)
But, I agree with many others here that the likelihood of stored plain text passwords is very high.
Hash(pw) + Hash(pw) := Hash(pw + pw)
(NB: Where '+' above is really just a stand-in for any pair of combining functions, not necessarily arithmetic addition or string concatenation.)
But, I agree with many others here that the likelihood of stored plain text passwords is very high.