Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.

I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)

Is there any secure way that this could be happening? Or are the companies storing my password in plain text?

  • GenderNeutralBro@lemmy.sdf.org
    12·
    1 year ago

    I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)

    They what?!

    This is a huge red flag and should not even be possible for your primary password, if they are following basic security principles. Are you sure this isn’t a secondary PIN or something like that?

    • lobster_irl@kbin.social
      5·
      1 year ago

      NatWest in the Uk does it for both the password and the pin, has been since I signed up like 10 years ago. I assumed they do it so you don’t enter a full password that someone could access later. No idea how they work out but they are big and I assume if it was insecure they’d have had issues by now. I assume they store the letter groupings in advance.

      • El Barto@lemmy.world
        5·
        1 year ago

        I assume if it was insecure they’d have had issues by now.

        At this point, it’s okay to assume that they have had issues and they haven’t disclosed them.

          • El Barto@lemmy.world
            2·
            1 year ago

            I’m not sure if they can be sued for that. Surely you can sue them if they get hacked and you’re negatively affected, though.

            • xavier666@lemm.ee
              0·
              1 year ago

              So i get the feeling that storing pw in plaintext is heavily frowned upon but not illegal

              • El Barto@lemmy.world
                2·
                1 year ago

                Not ilegal. Just very stupid. Like it’s not illegal to leave your house’s front door unlocked.

      • GenderNeutralBro@lemmy.sdf.org
        3·
        1 year ago

        I would assume they have the whole password in plain text, then. Not much you can do about it, just make sure you’re not re-using any part of that password for other services. And if you are, then you should start changing them all to something unique, ideally with a password manager like Keepass or BitWarden. This is a good habit anyway, because you can never really know how companies are handling their IT security.

        • lobster_irl@kbin.social
          3·
          1 year ago

          Crazy that that hasn’t become an issue for them yet! Thanks for the tips! I used to be pretty bad with my passwords but I’m reformed and using KeePass for everything these days.

          • curiosityLynx@kglitch.social
            1·
            1 year ago

            One of the greats back on r/TalesFromTechSupport had a story about how his company (a telco, iirc) did the following with passwords:

            1. Discard everything after the 8th character.
            2. Replace everything that isn’t a number or unaccented letter with the number 0.
            3. Store this “hash” in plaintext.

            A user could have a password that they thought was “štr0ng&longsupermegapasswordofdoom” and be able to log in with it, but what was stored was “0tr0ng0l” and they would have been able to log in with something like “!tröng$lips” as well.ä

            None of this was communicated to the customers.

            Obviously, once in a while a customer would call support because they were sure they had made a mistake entering their password but were able to log in anyway. And tech support had strict instructions to gaslight those customers that they must have entered the password correctly and just thought they made a mistake.