Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.

I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)

Is there any secure way that this could be happening? Or are the companies storing my password in plain text?

  • randombullet@lemmy.world
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    I’m assuming they’re plain text. There’s is no perceivable way they can only use those data points to to figure out which hash it is. Unless of course they’re using their own “hashing” function which isn’t secure at all since it’s probably reversible.

    • FearTheCron@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      Perhaps they validate the passwords client side before hashing. The user could bypass the restrictions pretty easily by modifying the JavaScript of the website, but the password would not be transmitted un-hashed.

      It is worth pointing out that nearly any password restriction like this can be made ineffective by the user anyway. Most people who are asked to put a special character in the password just add a ! to the end. I think length is still a good validation though and it runs into the same issue @randombullet@lemmy.world is asking about

      • Kissaki@feddit.de
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        How would they validate individual characters client side? The set password is on the server.

    • ayaya@lemmy.fmhy.ml
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      Theoretically they could take those two characters + a salt and then also store that hash. So there it is technically a way to do it although it’d be incredibly redundant, just ask for the actual password at that point.

      • hansl@lemmy.ml
        link
        fedilink
        arrow-up
        0
        arrow-down
        1
        ·
        1 year ago

        Please don’t do that. Brute force attacks are very easy on single characters, even two of them.