Some banking applications ask for random letters from your password, the 3rd, 5th and 6th letters for example.
Presumably this is to limit the effectiveness of sniffing the network traffic or keylogging to get password information.
I was wondering how this information is likely stored so that they are able to see individual characters in the password but presumably have them stored in a secure way?
Would each character get salted and hashed? If so would each get stored in different columns of a table? Or would each three letter permutation of the password characters get stored in a table unique to the user?