Is it possible to safely check for certain characters in a password? - eviltoast

Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.

I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)

Is there any secure way that this could be happening? Or are the companies storing my password in plain text?

  • El Barto@lemmy.world
    link
    fedilink
    arrow-up
    6
    ·
    1 year ago

    I assume if it was insecure they’d have had issues by now.

    At this point, it’s okay to assume that they have had issues and they haven’t disclosed them.

      • El Barto@lemmy.world
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        I’m not sure if they can be sued for that. Surely you can sue them if they get hacked and you’re negatively affected, though.

        • xavier666@lemm.ee
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          So i get the feeling that storing pw in plaintext is heavily frowned upon but not illegal

          • El Barto@lemmy.world
            link
            fedilink
            arrow-up
            2
            ·
            1 year ago

            Not ilegal. Just very stupid. Like it’s not illegal to leave your house’s front door unlocked.