10.09.2018, 11:32
Probably means they are either pure shit and don't hash your password at all, in which case you should leave their server because they obviously don't care about security at all.
Other scenario is that they hash your passwords but without a salt or the same salt for every account. In that case they have no idea what they are doing but it seems plausible this is just because of their lack of knowledge. You can either attempt to suggest them how it should be done or just leave the server.
In any decent setup, the stored passwords are hashed with a decent cipher (SHA-256 or above) and have a unique salt per account. Even better would be if they repeated the process multiple times to create a stronger hash (stretching), however that's optional IMHO.
Other scenario is that they hash your passwords but without a salt or the same salt for every account. In that case they have no idea what they are doing but it seems plausible this is just because of their lack of knowledge. You can either attempt to suggest them how it should be done or just leave the server.
In any decent setup, the stored passwords are hashed with a decent cipher (SHA-256 or above) and have a unique salt per account. Even better would be if they repeated the process multiple times to create a stronger hash (stretching), however that's optional IMHO.