Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
I’m assuming they’re plain text. There’s is no perceivable way they can only use those data points to to figure out which hash it is. Unless of course they’re using their own “hashing” function which isn’t secure at all since it’s probably reversible.
Perhaps they validate the passwords client side before hashing. The user could bypass the restrictions pretty easily by modifying the JavaScript of the website, but the password would not be transmitted un-hashed.
It is worth pointing out that nearly any password restriction like this can be made ineffective by the user anyway. Most people who are asked to put a special character in the password just add a ! to the end. I think length is still a good validation though and it runs into the same issue @randombullet@lemmy.world is asking about
I have never heard of anything secure doing that. Assuming they have taken security steps, it would mean they recorded those characters in plaintext when you set your password, but that means that at least those characters aren’t secure, and a breach means some hacker has a great hint.
When the hashing occurs, it happens using the code you downloaded when you visit the site, so it’s your computer that does the hash, and then just the hash is sent onwards, so they can’t just pull the letters out of a properly secure password.
A secure company would use two-factor authentication to verify you above and beyond your password, anyway, since a compromised password somewhere else automatically compromises questions about your password.
Unless they hash and store various combinations of characters in addition to, or instead of, the whole password. I haven’t heard of anyone doing this. If you were to pad them with a unique salt and a pepper before hashing each combination,
you could end up with something more secure than just hashing the whole passwordEdit: I was wrong it seems; you’d still end up with something insecure. But hashing the whole password, if done properly, is already secure enough so this would seem like needless complication unless there’s some unusual concern about the password being intercepted in transit, and in that case you’d have other problems anyway.I have heard of this thing of asking for selected characters of a static second authentication factor (e.g. a PIN), but not of a password itself. And now that we have proper 2FA systems I haven’t seen anything like that in a while.
It’ll be less secure.
If they hash a subset, then those extra characters are literally irrelevant, since the hash algorithm will exclude them. Like if they just hashed the first 5 characters, then “passw” is the same as “password” and all those permutations. Hashing is safe because it’s one-way, but simple testing on the hashing algorithm would reveal certain characters don’t matter.
Protecting a smaller subset of characters in addition to the whole password is slightly better but still awful. Cracking the smaller subset will be significantly easier using rainbow tables, and literally gives a hint for the whole password, making a rainbow table attack significantly more efficient. Protecting the whole thing (with no easy hints) is way more secure.
It also adds nothing to keylogging, since it’s not even a new code, it’s part of the password.
There was a time where that level of security was acceptable, and it still could be ok on a closed system like an ATM, as the other reply to my comment pointed out, but this kind of protection on a standard computer is outdated and adds holes.
Less secure if you come at it from the perspective of cracking the password, but probably more secure in real-world terms.
If you type in your bank password and somebody’s compromised your browser, they now have your entire password.
If you type in the third, fourth and eighth digits and somebody’s compromised your browser, they still can’t access your account.
Obviously full 2FA is probably better, but
- A bank requiring a smartphone to bank with them is probably a no-go
- A bank probably has to deal with some of the least technical users that are out there
If it’s too hard for certain users to engage with the system correctly, they’ll try to sneak around it in ways that could compromise their security more than if the bank had just gone with the specific digits thing in the first place.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
They what?!
This is a huge red flag and should not even be possible for your primary password, if they are following basic security principles. Are you sure this isn’t a secondary PIN or something like that?
NatWest in the Uk does it for both the password and the pin, has been since I signed up like 10 years ago. I assumed they do it so you don’t enter a full password that someone could access later. No idea how they work out but they are big and I assume if it was insecure they’d have had issues by now. I assume they store the letter groupings in advance.
I would assume they have the whole password in plain text, then. Not much you can do about it, just make sure you’re not re-using any part of that password for other services. And if you are, then you should start changing them all to something unique, ideally with a password manager like Keepass or BitWarden. This is a good habit anyway, because you can never really know how companies are handling their IT security.
Crazy that that hasn’t become an issue for them yet! Thanks for the tips! I used to be pretty bad with my passwords but I’m reformed and using KeePass for everything these days.
I assume if it was insecure they’d have had issues by now.
At this point, it’s okay to assume that they have had issues and they haven’t disclosed them.
Can a company be sued for storing pw in plaintext?
I’m not sure if they can be sued for that. Surely you can sue them if they get hacked and you’re negatively affected, though.
So i get the feeling that storing pw in plaintext is heavily frowned upon but not illegal
Not ilegal. Just very stupid. Like it’s not illegal to leave your house’s front door unlocked.
Good question. A lot of banks in Europe use this type of setup, where it will ask you for 3-4 characters of your pin/password, both to login and to confirm transactions. I always thought it was weird but never thought about the security implications.
I do have this with my bank as well, but I have always had to enter a full username and different password before it asks for those
I always figured they checked the plaintext locally before hashing and sending it to their server, but I don’t really know.
This is it.
It seems a lot of people have trouble distinguishing between what’s simply happening in their browser, and what’s being sent back to the server. I mean, I get it; it’s confusing, even to the people creating the tech, let alone a casual netizen. It’s a good question, and you can’t fault anyone for wondering what’s what.
Yes, asking these questions is a fantastic thing.
Speaking of questions - I imagine there is a day to use the built in dev tools in the browser to verify that the particular site does this, but I don’t know how. Do you happen to know how I might?
I remember signing up for a site a few years ago and they emailed me my confirmation, with my password, in plaintext. I was absolutely shocked
Just a heads-up, your comment is posted twice.
Not sure if there are any browser dev tools that do what you’re specifically asking. It’s more that you need to know what to look for in the source code, and the tools just aid in finding/editing/testing things. Even if you learn a dozen coding languages, and know what to look for, they may be sending the password as plain text and then doing the dirty work server-side. Maybe they send a single-use key to your browser, hash and send the password with that, then re-hash it on the server, with a private key. There are numerous ways to accomplish the task, and I’m glad I didn’t start any arguments with my simplistic “this is it” statement.
All of that said, I’ve been out of practice for quite a while, and I was never a wizard anyhow. So, maybe someone else can offer a catch-all solution, but I really doubt it. Regardless, being aware and vigilant puts you way ahead of the pack, so nice work there.
that doesn’t explain the scenario described in the post
You’re right, I misread the post. What sites have done that? I’ve been fortunate to never encounter any.
A bunch of European banks.
Might be time to switch banks…
They all do it. It’s perfectly secure if you don’t implement it in a naive way.
No, they aren’t storing your password in plaintext.
How is it implemented?
There’s a security stack exchange on this exact question here.
Storing your credentials in plaintext would be insane, illegal, and would never pass any kind of audit.
They could hash pairs of characters on password creation and store those. Seems like more data points to guess the original password, but maybe the math is hard enough it doesn’t do much.
If it’s uniquely salted (and especially if they use a secret pepper too) it might not help with guessing the password, because now you have to crack several hashes of long random sequences of bytes instead of just one.
If you have the password hashes, you almost certainly have the salts. Salts prevent the same password used by different users having the same hash, but if you’re bruteforcing, they don’t really add to complexity.
Bruteforcing 2 characters + a salt is computationally the same as bruteforcing 2 characters.
Full-stack dev here, not necessarily in answer to OP’s question, but in my experience it is a pretty standard practice that when you log in to a service, the web page sends your unhashed creds to the server, where your password is then hashed and compared to the stored hash. Via HTTPS/TLS/SSL, this is a reasonably secure practice since the creds are still encrypted while in transport. Hashing is a computationally expensive process that (before the advent of WASM) wasn’t really feasible to do on the client side.
What is WASM ?
Web Assembly. Pretty neat tech if you read up on it.
I’ve only seen this as a second factor after entering a full password. Although it has mostly been replaced by actual 2FA now. Last time I remember this type was on the uk gov student finance website
The 2 occasions I can think of, it was characters from my main password. Both were during contact with the Support teams. I no longer have service with either of the companies (due to unrelated reasons)
This is typically used for a secondary authentication factor in most instances, such as a service ID number after you’ve already provided a username, and entered at the same time as a password.
It is not possible for them to securely be storing the password yet being able to retrieve individual characters at the same time.
Something fun you can do is set your password to an eicar test string. That should break things of they are running any av and storing the password in clear text
The way I’ve seen this done before, it was not for a password, but for a token entered after the password was entered. No, the token is not encrypted, and therefore it would not be secure for the service to use it as a password.
Any password restriction that LOWERS entropy is a bad restriction.
No, I’m not answering the question, I know. But I’m answering the better question, which is “is this a stupid thing to ask of a password?”, and yes it is.
There’s a security exchange thread on it here
It looks like there are certain kinds of algorithms you can run that give you this property.
Also, I’ve seen this when you have an alternate form of authentication like a password you type in full, or an existing session token. In those scenarios, you could probably use some sort of symmetric key encryption to encrypt the secondary password with the primary password / session token in such a way that you aren’t storing the key and can’t decrypt it, but that you can check specific digits on command.
