3 ms·
The Nth letter of password thing sounds sketchy to me. Mostly because it sounds like they have my password in plaintext if they can check that.
by sbradford26 8y ago
The Nth letter of password thing sounds sketchy to me. Mostly because it sounds like they have my password in plaintext if they can check that.
- Dayshine 8y agoIt's usually in addition to a password.
- chme 8y agoNo they just store a checksum for every letter of your password. /s
- kevin_thibedeau 8y agoI'd hope they at least apply ROT13.
- dmurray 8y agoThey may have it in 2-way encryption in a HSM. That's not what will ever be recommended in a beginner guide to handling passwords for your SaaS, but it's a reasonable approach for a bank.
- new299 8y agoYes, it almost certainly is quite sketchy... I can’t think of any way it could be securely implemented. In the case I’ve seen it’s the only password used... I wonder if there is a hashing scheme that would work with some kind of ambiguous entry... I.e. “is the 3rd digit between 5 and 10”. If you could confirm certain properties of a password/pin from its hash...
- Filligree 8y agoI could believe this would be possible with homomorphic encryption, even with today's capabilities, but I can't prove that; I'm not terribly familiar. That is not to say that it's very likely, because it's not.