Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.

I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)

Is there any secure way that this could be happening? Or are the companies storing my password in plain text?

  • curiosityLynx
    2•1 year ago

    One of the greats back on r/TalesFromTechSupport had a story about how his company (a telco, iirc) did the following with passwords:

    1. Discard everything after the 8th character.
    2. Replace everything that isn’t a number or unaccented letter with the number 0.
    3. Store this “hash” in plaintext.

    A user could have a password that they thought was “štr0ng&longsupermegapasswordofdoom” and be able to log in with it, but what was stored was “0tr0ng0l” and they would have been able to log in with something like “!tröng$lips” as well.ä

    None of this was communicated to the customers.

    Obviously, once in a while a customer would call support because they were sure they had made a mistake entering their password but were able to log in anyway. And tech support had strict instructions to gaslight those customers that they must have entered the password correctly and just thought they made a mistake.