Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.

I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)

Is there any secure way that this could be happening? Or are the companies storing my password in plain text?

  • ayaya@lemmy.fmhy.ml
    link
    fedilink
    arrow-up
    21
    ·
    1 year ago

    Theoretically they could take those two characters + a salt and then also store that hash. So there it is technically a way to do it although it’d be incredibly redundant, just ask for the actual password at that point.

    • hansl@lemmy.ml
      link
      fedilink
      arrow-up
      12
      arrow-down
      2
      ·
      1 year ago

      Please don’t do that. Brute force attacks are very easy on single characters, even two of them.

      • r00ty@kbin.life
        link
        fedilink
        arrow-up
        4
        ·
        1 year ago

        Yes, I did a reply about this above because this idea has been suggested a few times and it’s truly a bad security move. I’d prefer they just encrypted it and made sure the key was stored separate from the database. That’s more secure than this idea.