Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.

I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)

Is there any secure way that this could be happening? Or are the companies storing my password in plain text?

  • kambusha@lemmy.ml
    link
    fedilink
    arrow-up
    7
    ·
    1 year ago

    Good question. A lot of banks in Europe use this type of setup, where it will ask you for 3-4 characters of your pin/password, both to login and to confirm transactions. I always thought it was weird but never thought about the security implications.

    • pandarisu@lemmy.worldOP
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      I do have this with my bank as well, but I have always had to enter a full username and different password before it asks for those