4 ms·
This is pretty standard for UK banks. They'd do a hash of each character of the password (in Lloyds' case, your "memorable word" combo), to compare your entrie
by nrki 10y ago
This is pretty standard for UK banks.
They'd do a hash of each character of the password (in Lloyds' case, your "memorable word" combo), to compare your entries to.
- benkuhn 10y agoWait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every option if you only have a hash of the full password, but only 10*26 = 260 attempts to test every option for every individual character.
- brassic 10y agoI have to use two passwords to login to Lloyds bank. One conventional password (which is presumably stored salted and hashed) and one where I have to enter characters from three positions they choose. The latter is intended to mitigate the risk of using your account from a vulnerable computer. The former takes care of vulnerabilities on their end (as far as any password can).
- Symbiote 10y agoCould they implement something like: Password: money Secret word: ABCD If they're going to ask for two characters from the secret word, they could then hash saltmoneyAB saltmoneyAC saltmoneyAD saltmoneyBC saltmoneyBD saltmoneyCD and check against the relevant one.
- nrki 10y agoI may be incorrect on the "hash each letter individually" part. But this is combined with a password.