Assuming a password is not stored in plain-text, how is it possible that a support guy is able to identify during a phone call a customer by asking him random characters of his password?

For example, if the password is "password", the support guy asks for the first and fourth characters, the customer says 'p' and 's'. At this point, the support guy considers he's speaking with the legitimate customer.

The only solution that comes to my mind is that they are using plain-text passwords, but I hope that's no the case and that there is another solution, because it's a bank...

PS: It's a real scenario, no a phishing attempt.

EDIT: as Matthew said, without having access to their system is impossible to know what is going on. The goal of my question was to known if there are any known "public" methods to achieve this, not a custom made algorithm.

  • 2
    So, in 2016 there are banks using a two-character identity verification scheme?
    – Arminius
    Nov 15 '16 at 17:34
  • @Arminius and what if I tell you it's one of the largest international banks?just LOL...
    – Ay0
    Nov 16 '16 at 8:13

The point of a cryptographic hash is to not be reversible, so they can't be getting it from that.

It's possible they pick out and store a few characters from the password when it's set, so customer service knows what characters 1 and 4 are, but not 2 or 3. However, I'd strongly suspect they're storing the password in reversible encryption, because that's much simpler of an explanation, and banks aren't known for having great information security practices.


Could be that they hash a series of character pairs (with a strong salt, using a decent algorithm), and details as to which pair of characters this is. If they then ask for the characters the system requests, the system can hash and return a true or false response. It shouldn't change which pair it asks for until a true response has been found, or three (for example) attempts have happened.

In this case, you wouldn't need plain text passwords being stored, the customer service person wouldn't be able to access more than 2 characters (and would only be able to verify them in an auditable way), and the weakest point would be the relatively low entropy of two letters.

However, you can't tell if that's what they do without access to their systems...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.