5 ms·

One of the largest banks in Japan once sent over me a piece of paper on which the password I set was written :)

by tnzk 4y ago

sva_ 4y ago
I once lost my sim card and wanted to lock it, so I called the phone company and they asked me for the first 3 characters of my password to verify myself.
- smcl 4y ago
  So I know what you’re thinking but it is at least technically possible that they don’t store it as plaintext - like maybe when you set the password it stored a salted hash of the whole thing, plus also a special hash of the first 3 chars for emergency recovery or locking operations (ie can be used when you show up in-person with the photo ID they have on file). So they’d enter the characters, and compare the hash and you’d then follow password reset process offline. But … while it’s possible, I think we all know they probably just stored it as plaintext :-D
  - seoaeu 4y ago
    Storing a hash of the first three characters still cripples the security. It is trivial to brute force a hash when there’s only 62^3 possibilities. And once you know the first characters, brute forcing the remaining ones is exponentially easier
    - smcl 4y ago
      It absolutely does and you're right it would still be stupid (though making 62^3 phone calls or store visits might not be feasible). I was trying to say it doesn't necessarily mean your password is stored in the clear. But honestly I think any time you're prompted like this for something that might get implemented via storing a password in the clear it probably means it was been implemented that way.
      - hnlmorg 4y ago
        I always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places where people might overhear. So you have a password but ask for a different (random) combination of 3 characters from it each time. It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand). The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.

One of the largest banks in Japan once sent over me a piece of paper on which the password I set was written :)

by tnzk 4y ago

One of the largest banks in Japan once sent over me a piece of paper on which the password I set was written :)

sva_ 4y ago

I once lost my sim card and wanted to lock it, so I called the phone company and they asked me for the first 3 characters of my password to verify myself.

smcl 4y ago
So I know what you’re thinking but it is at least technically possible that they don’t store it as plaintext - like maybe when you set the password it stored a salted hash of the whole thing, plus also a special hash of the first 3 chars for emergency recovery or locking operations (ie can be used when you show up in-person with the photo ID they have on file). So they’d enter the characters, and compare the hash and you’d then follow password reset process offline. But … while it’s possible, I think we all know they probably just stored it as plaintext :-D
- seoaeu 4y ago
  Storing a hash of the first three characters still cripples the security. It is trivial to brute force a hash when there’s only 62^3 possibilities. And once you know the first characters, brute forcing the remaining ones is exponentially easier
  - smcl 4y ago
    It absolutely does and you're right it would still be stupid (though making 62^3 phone calls or store visits might not be feasible). I was trying to say it doesn't necessarily mean your password is stored in the clear. But honestly I think any time you're prompted like this for something that might get implemented via storing a password in the clear it probably means it was been implemented that way.
    - hnlmorg 4y ago
      I always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places where people might overhear. So you have a password but ask for a different (random) combination of 3 characters from it each time. It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand). The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.