Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
A lot of banks in the UK do it. They normally have a secondary pin that they will ask for 2 or 3 characters of.
This means that if you log in and get keylogged/shoulder surfed etc they don’t get the full pin. The next time you login you will get asked for different characters.
Not great, but not awful either - going away now that 2fa is more common
A secondary pin is a bit better but characters from the actual password (that you have to enter anyway) adds nothing to security from that kind of intrusion.
This seems somehow worse than simply requiring the same few characters each time, since they would either have to store the complete passwords in plaintext, or compute and store the hash for every permutation of 2-3 characters, which is wildly inefficient. You’d also be susceptible to leaking your password if for some reason you are under long term surveillance, since at some point you would presumably have provided all of the characters making up the password.
It’s normally an additional password/code, so it’s probably stored in plaintext.
The random character selection is what makes it useful. Stops someone who just captured your details from logging straight in (probably).
2FA is superior in every way to it. Most have now switched to sending you a chip & pin card reader to generate OTPs.