3 ms·
They could be storing a hash for each trigram in the password (assuming he meant three consecutive characters starting from a random offset). Although it might
by pfg 11y ago
They could be storing a hash for each trigram in the password (assuming he meant three consecutive characters starting from a random offset). Although it might still leak information that could improve a brute force, I suppose.
It's not a good solution anyway. A phishing page could easily claim the entered password was wrong and ask for another one (starting at another offset). Most passwords are probably <= 9 characters, so you'd have the full password after 3 attempts.
- Reason077 11y agoIt's not consecutive characters, it's a random set of three. One time it might ask me for the 1st, 6th, and 8th characters. The next time for the 6th, 7th, and 9th. Passwords are required to be at least 8 characters and contain a mix of letters and numbers. Fishing attacks are difficult because the attacker would have to be able to determine which bank a card was issued by, and present the correct 3D secure interface specific to that issuer. Many issuers also add a customer-personalised image or message to the interface to further reassure customers of authenticity.
- Amezarak 11y agoThis further suggests to me your bank is storing your password in plaintext or reversibly encrypted, which is not secure at all. The only alternative I can think of is that they'd also create and store a hash of every possible three-letter combination based on your password which does not seem likely.