3 ms·
It's entirely possible that the phone representative is entering your password into their system, which then checks it against the stored hash.
by dublinben 12y ago
It's entirely possible that the phone representative is entering your password into their system, which then checks it against the stored hash.
- jerf 12y agoTry reading your password to somebody else and getting them to enter it correctly. Unless your password is terrible, you should find that you can tell the difference between them verifying a text field vs. entering it into the system pretty easily.
- JoshTriplett 12y agoYeah. I always use random passwords for the answers to "security questions", and it's fascinating to read them off over the phone. It's obvious that they're stored in the clear, because they don't care about (for instance) case or spacing.
- icebraining 12y agoThe system could normalize the password (convert to upper/lowercare, remove spaces) before hashing it. It'd be dumb, but not as bad as storing in plain text. I don't find that likely, though.
- streptomycin 12y agoAmazon used to do it: http://www.wired.com/2011/01/amazon-password-problem/ http://www.wired.com/2011/01/amazon-password-problem/
- TallGuyShort 12y agoUnless it's "CorrectHorseBatteryStaple"