6 ms·
Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th char
by _asummers 8y ago
Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th character at all? The site should just have a hash of my password (normalizing the length).
- john-radio 8y agoI guess (hope) they just have a collection of patterns that they apply (like (3, 9, 11, 12, 15) from the OP), and when they store your password's hash, they also store the hash of those several characters so that they can present the pattern to you later and check whether you matched the pattern correctly.
- andrewla 8y agoI can't think of any way that this could be made secure outside of specialized hardware. If a system exists that can query some static data for whether a selected subset of characters is correct, then brute-forcing the underlying password becomes stupidly trivial. Similarly for pre-hashing certain subsets; a four-character password can be too easily brute forced.