3 ms·
Storing a hash of the first three characters still cripples the security. It is trivial to brute force a hash when there’s only 62^3 possibilities. And once you
by seoaeu 4y ago
Storing a hash of the first three characters still cripples the security. It is trivial to brute force a hash when there’s only 62^3 possibilities. And once you know the first characters, brute forcing the remaining ones is exponentially easier
- smcl 4y agoIt absolutely does and you're right it would still be stupid (though making 62^3 phone calls or store visits might not be feasible). I was trying to say it doesn't necessarily mean your password is stored in the clear. But honestly I think any time you're prompted like this for something that might get implemented via storing a password in the clear it probably means it was been implemented that way.
- hnlmorg 4y agoI always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places where people might overhear. So you have a password but ask for a different (random) combination of 3 characters from it each time. It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand). The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.