Perhaps when you set the password it generates a bunch of combinations of password chars that might ask you to enter and then hash these. Of course that does ma

Perhaps when you set the password it generates a bunch of combinations of password chars that might ask you to enter and then hash these. Of course that does make them more exploitable because you can leak information about the password 1 or 2 characters at a time. However your bank will have so much information stored about you that if your bank gets owned you're basically fucked anyway even if they don't get your password. I imagine the servers that actually store this data however are secure to a ridiculous degree.