Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to my previous password.
Now these immediately raised my eyebrow because it means to be able to compare the string of my new password to previous password, they are either stored in plain text (surely not for a webhosting company), or stored with an algorithm that can be decrypted (which isn't really much better)?
Or is this an issue with cPanel as a whole? Earlier this week I signed up for a plan with a .com company that uses cPanel and I noticed when I entered my password on the next screen it said your password was successfully changed to "xxxxx"... I don't know if this data was ever stored but I haven't put anything on this site due to this concern.
Is it possible that they are using an encryption technology like PGP to decrypt the password?
I have e-mailed both companies asking for clarification on this issue but I fear I'll only get "company speak" back from them.
I'm not sure this question is exactly fits in with SO's Q&A structure however password security is one of the most important things on the internet IMO, and if the company hosting your websites has poor security then that is a serious issue.