3 ms·

I like the system where you only enter parts of your password. It means that even with a key logger or hacked site, you’d need several logins to be able to scra

• iso1631 6y ago
  That means the password is held in plain text or reversable encryption. They should only have a salted hash of your password. Using a shared secret in addition to a salted password is probably acceptable, although how much extra security it gives is debatable.
  • ithkuil 6y ago
    Possibly or they could store N salted hashes, one for one of the N permutations of a mask over the password character positions. This basically splits the end user password into N passwords with smaller entropy but this can be mitigated by requiring high entropy for the original password.
    • iso1631 6y ago
      Making it insanely easy to brute force if you have access to the hashes (if they ask for 2 characters, assuming a-zA-Z0-9 you're talking maybe 4k permetations, and then you know 2 characters) A 10 character 64 symbol phrase would take 64^10, or 1e18 guesses 5 lots of 2 characters 64 symbols would take 5*64^2, or 20k guesses
      • ithkuil 6y ago
        If the "sub" passwords are 2 char long then then they have way too less entropy. For this to that make any sense it must use a sizable subset of the full password (which must be longer than usual to accommodate for that. And all this to protect for keyloggers. Probably a hardware token second factor is more effective.
• ArgyleSound 6y ago
  Yet it also suggests the password is being stored insecurely in the server.