Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
You may be right. I was thinking that the strings would be padded with a random pepper and a unique salt though, before hashing. So the string “sw” might become “swrP86#UlRA64%KGjBICfyO!6” with the unique salt and then “awrP86#UlRA64%KGjBICfyO!6L6ZCf3#T##ssUPjfOMXL^YGZ" with pepper added before hashing, while the string “od” might become "odjaSmh&1$n1##1#400AjQE10kXL6ZCf3#T##ssUPjfOMXL^YGZ” (salt shown in italics). Then you’d be trying to crack these long strings rather than just two-character strings. Of course, if someone steals the DB they would have the unique salt, which would reduce the difficulty to that of guessing two characters plus the pepper (assuming the pepper is stored securely elsewhere), but that’s still quite difficult.
The issue with salt is that it is stored with the password hash. So you’d pretty much get that information with the password. It’s only designed to make sure the hash won’t be the same for the same password on other users, not to make breaking the hash any harder on its own.
You could store it (and/or pepper) wherever the password is actually checked and splitting it would help. But I cannot imagine they’re doing that. It’s far more likely they’re encrypting the password and keeping the key off the database server. Meaning they need to get both, to get passwords.
Yes, my understanding is that the pepper is usually supplied from another source (not stored in the database), specifically to make it more difficult for anyone who steals the database to crack the password hashes. It would mean that if you stole this hypothetical db with two-letter subsets of the password in it, and got the salts too, you’d still be cracking the hash of a much longer string. But if you figured out that one string (pretty hard to do), you’d have the whole lot.