3 ms·
It absolutely does and you're right it would still be stupid (though making 62^3 phone calls or store visits might not be feasible). I was trying to say it does
by smcl 4y ago
It absolutely does and you're right it would still be stupid (though making 62^3 phone calls or store visits might not be feasible). I was trying to say it doesn't necessarily mean your password is stored in the clear. But honestly I think any time you're prompted like this for something that might get implemented via storing a password in the clear it probably means it was been implemented that way.
- hnlmorg 4y agoI always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places where people might overhear. So you have a password but ask for a different (random) combination of 3 characters from it each time. It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand). The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.