4 ms·
Reminds me of the banks with their "enter the first and fourth characters of your password"-type enhanced login forms. How are they doing that without storing t
by bonaldi 14y ago
Reminds me of the banks with their "enter the first and fourth characters of your password"-type enhanced login forms. How are they doing that without storing the plaintext, then?
- columbo 14y agoTechnically they could encrypt the password and then just put the 1st and 4th password in a separate column in the db. Not sure if that happens in practice...
- jiggy2011 14y agoPerhaps when you set the password it generates a bunch of combinations of password chars that might ask you to enter and then hash these. Of course that does make them more exploitable because you can leak information about the password 1 or 2 characters at a time. However your bank will have so much information stored about you that if your bank gets owned you're basically fucked anyway even if they don't get your password. I imagine the servers that actually store this data however are secure to a ridiculous degree.
- OMBUG 14y agoI know Halifax at least uses a separate string for those checks, which presumably is stored unencrypted.