Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
They could hash pairs of characters on password creation and store those. Seems like more data points to guess the original password, but maybe the math is hard enough it doesn’t do much.
If it’s uniquely salted (and especially if they use a secret pepper too) it might not help with guessing the password, because now you have to crack several hashes of long random sequences of bytes instead of just one.
If you have the password hashes, you almost certainly have the salts. Salts prevent the same password used by different users having the same hash, but if you’re bruteforcing, they don’t really add to complexity.
Bruteforcing 2 characters + a salt is computationally the same as bruteforcing 2 characters.