I phoned into a financial company's website, and it prompted me to key in my password on the phone keypad, converting the alphabetic characters to the corresponding digit, and special symbols to '*'.

How can they possibly make this work without storing the password in some reversible format internally? Storing a salted hash of the password would not allow this sort of password verification without them checking every possible digit->alpha combination and every possible '*'->symbol mapping.


One possibility is to store a second hashed password. Store the hashed real password, and at the same time map that plaintext password to the keypad equivalent, and store the keypad equivalent as a second hash (and second salt).

  • 1
    Such an obvious solution that I'm tempted to delete my question out of pure shame. Can I downvote my own question? – mwhidden Sep 15 '15 at 16:31
  • 1
    I actually think you asked an excellent question. And, we may be giving that company too much credit! – Edward Barnard Sep 15 '15 at 16:38
  • 2
    If that is the case, that is a very exploitable attack vector – Richie Frame Sep 16 '15 at 2:28
  • 1
    It would also be possible (but very unlikely) that they replace the alphabets with a specific alphabet and all special characters with a specific character before hashing. For example, replace a, b and c with b, and replace all special characters with a * symbol and then calculate the hash. If this is the case, you can check by interchanging 1 of the letters with another and any special character instead of the correct one on the website and it would let you login. – Chirag Bhatia - chirag64 Sep 16 '15 at 18:20
  • 1
    @Richie Frame : how so? the salts are different. You mean because the search space for the keypad password (eg., 52-ish keys mapped down onto 10-ish) is reduced in the case that the hashes are made public? – mwhidden Oct 10 '15 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.