3 ms·
NatWest is also guilty of storing passwords in plain text: their login page says 'enter the 5th, 8th and 12th character of your password'
by MarkMc 9y ago
NatWest is also guilty of storing passwords in plain text: their login page says 'enter the 5th, 8th and 12th character of your password'
- allyant 9y agoTo be fair we can't be 100% sure of that. It is possible they simply hash all the combinations they are going to show you. Could also be stored in an HSM making it a bit more secure.
- dan1234 9y agoWho's to say they haven't just hashed each individual character of the password?
- MarkMc 9y agoDoes that offer any real protection? I could try each possible character until I find the hash.
- NickLamp 9y agoYou are correct. He was joking
- wlll 9y agoIf you're storing individually hashed characters: a: 0CC175B9C0F1B6A831C399E269772661 b: 92EB5FFEE6AE2FEC3AD71C777531578F c: 4A8A08F09D37B73795649038408B5F33 etc. then this is basically the same as storing the plaintext characters because as long as you know the hashing algorithm you can generate a pretty small map of hash -> original character and convert back.