When your client wants you to store password in plain text and it makes your life easier but it still feels really wrong

Please don't :'(

Is one even allowed to do that?

Cash the cheque and report them to the GDPR regulator anonymously

@620hun us only company :(

I'd downright refuse unless it was bcrypt or sha256

That's when you dump the client.

Refuse.

Never. Even less so if they ask for it. This literally has no ethical and sustainable use cases.

“Sorry, but no. I won't contribute to you getting hacked.”

You know what happens when your client gets hacked? It's all your fault. Sure, he told you to store the passwords in cleartext, but you should have made it so he didn't get hacked in the first place. Nothing you say will make him change his mind, the blame falls entirely on you and he'll make sure that all his customers know that you screwed him by not storing cleartext passwords securely.

Even if your client turned out to be an understanding person, better prepare for the above scenario. 😉

Dont

What? Hope the client doesn't have real customers