3 ms·

Or worse, if they ask you to type your password into a phone keypad (eg. the 9 button stands in for [9w-zW-Z] and 0 for all punctuation). Not only does this mea

Or worse, if they ask you to type your password into a phone keypad (eg. the 9 button stands in for [9w-zW-Z] and 0 for all punctuation). Not only does this mean they're storing your password in plaintext, but reducing the character set to just 0-9. A major financial company does this, of all the terrible places.

kragen 11y ago
It doesn't imply they're storing your password in plaintext, no.
- mikeash 11y ago
  It doesn't guarantee it, but it does imply it pretty heavily. The alternative is that they're smart enough to come up with a clever scheme like hashing your password in both its raw form and when converted to 0-9, but not smart enough to realize how converting your password to 0-9 makes it vastly less secure.
  - kragen 11y ago
    No, it's easy for them to convert your password to 0-9 when you enter it on a regular keyboard, before hashing it. It does make it vastly less secure, yes, but it doesn't imply plaintext storage.
    - mikeash 11y ago
      Isn't that what I said in my second paragraph? As I said, for that to happen, you need people smart enough to come up with that scheme but not smart enough to realize how insecure it is. Possible but unlikely. "Imply" does not require a complete guarantee.
      - kragen 11y ago
        I was talking about logical implication, which does require a complete guarantee. I didn't realize you weren't.
      - abduhl 11y ago
        Does it actually make it less secure though? Consider the situations where each password is used: 1. Your password is required online where the full password must be entered and the numerically reduced password is not accepted. This results in no loss of difficulty in the password. 2. Your password is required over the phone where the password is reduced to a T9 password. Despite the fact that the solution space has been cut down significantly (by 33%^n), the password cannot be broken any quicker because the bottleneck for this case is not computational power but rather the phone system. You can brute force all of the passwords in X seconds, but this is irrelevant because you can't try more than 1 password per call and you can't call more than Y times per second.
        mikeash 11y ago
        Good points. I would still say yes, although it's not a particularly huge problem. One scenario where it could be problematic is if the password database is stolen and nobody notices. They could then potentially brute force your numeric password and then access your account by phone. In the universe of banking this is pretty small potatoes, though. My bank uses a case insensitive comparison for passwords (!), limits them to 8 characters (!!), and silently truncates anything over the limit (!!!!!!!!!!!!!!!!!!!!!!!!!!). They say they're fixing it. But it sure is taking a long time.

kragen 11y ago

It doesn't imply they're storing your password in plaintext, no.

mikeash 11y ago
It doesn't guarantee it, but it does imply it pretty heavily. The alternative is that they're smart enough to come up with a clever scheme like hashing your password in both its raw form and when converted to 0-9, but not smart enough to realize how converting your password to 0-9 makes it vastly less secure.
- kragen 11y ago
  No, it's easy for them to convert your password to 0-9 when you enter it on a regular keyboard, before hashing it. It does make it vastly less secure, yes, but it doesn't imply plaintext storage.
  - mikeash 11y ago
    Isn't that what I said in my second paragraph? As I said, for that to happen, you need people smart enough to come up with that scheme but not smart enough to realize how insecure it is. Possible but unlikely. "Imply" does not require a complete guarantee.
    - kragen 11y ago
      I was talking about logical implication, which does require a complete guarantee. I didn't realize you weren't.
    - abduhl 11y ago
      Does it actually make it less secure though? Consider the situations where each password is used: 1. Your password is required online where the full password must be entered and the numerically reduced password is not accepted. This results in no loss of difficulty in the password. 2. Your password is required over the phone where the password is reduced to a T9 password. Despite the fact that the solution space has been cut down significantly (by 33%^n), the password cannot be broken any quicker because the bottleneck for this case is not computational power but rather the phone system. You can brute force all of the passwords in X seconds, but this is irrelevant because you can't try more than 1 password per call and you can't call more than Y times per second.
      - mikeash 11y ago
        Good points. I would still say yes, although it's not a particularly huge problem. One scenario where it could be problematic is if the password database is stolen and nobody notices. They could then potentially brute force your numeric password and then access your account by phone. In the universe of banking this is pretty small potatoes, though. My bank uses a case insensitive comparison for passwords (!), limits them to 8 characters (!!), and silently truncates anything over the limit (!!!!!!!!!!!!!!!!!!!!!!!!!!). They say they're fixing it. But it sure is taking a long time.