Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
Yes, my understanding is that the pepper is usually supplied from another source (not stored in the database), specifically to make it more difficult for anyone who steals the database to crack the password hashes. It would mean that if you stole this hypothetical db with two-letter subsets of the password in it, and got the salts too, you’d still be cracking the hash of a much longer string. But if you figured out that one string (pretty hard to do), you’d have the whole lot.