On: Pandora doesn't hash their passwords

[pbreit]

Since they key is almost definitely not stored in the db and is very likely stored fairly securely, why does it follow that "if [passwords] are accidentally exposed, it's likely the key is also exposed"?

I understand that passwords are better hashed I just don't nderstand why encrypted is no better than plain text (according to some).

[mikeash → pbreit]

How do you store the key more securely than the database while still allowing your web apps to access the key whenever they need to verify or change someone's password?

[pbreit → mikeash]

Well, it's common to have db but not file system or codebase access. And it's easy to make a directory readable by only the app.