I am a customer of a company that has quite a bit of personal/financial information about me. I had to call their help desk the other day and was asked to type my online password in on the keypad on my phone to confirm it's me.

Does this necessarily mean that they are storing my password in plain text? Shouldn't they be unable to confirm my password over the phone if it was properly hashed?

  • Is the password all numbers? What is the max length a password can be? Were you asked for the password by a human or an automated system? – schroeder May 31 at 13:36
  • The passwords can contain letters and numbers only, and for a letter you type in the number with that letter (eg. hit 5 once for a K). I'm not sure what the max length is. The password is requested by their automated system. – KBall41 May 31 at 13:58
  • This sounds like something Fidelity does - I've always wondered what security implications it has. – Cowthulhu May 31 at 13:59
  • It's a golden opportunity for MITM attacks, and then to use your password elsewhere. – Patriot May 31 at 14:26
  • How long is the password? They could simply "brute force" all possible passwords that match the numpad sequence... although this is going to be hard if you have symbols+case sensitive password... – Giacomo Alzetta Jun 3 at 14:15

It does not mean that the passwords are in plaintext. It is possible that they could process your password, when you originally set it, to convert it into the numberpad equivalent and store that, either in plaintext or hashed.

There are a few different ways that this process could be concerning, and worth a question or two about how they process passwords.

My greater concern is how they handle the password you type into your phone. That is most likely stored in their help desk system without any protections. Whatever they do to compare it to your stored password, there must also be a process to protect the password you type in.

My guess is that they calculate the numperpad equivalent of your password and store that number in plaintext in your account notes. It is then compared against what you type in when prompted on the phone.

  • 1
    They could still hash it though? If it's being number-pad entered, it's being picked up by an automated system, so it could hash-and-compare just as well. – Clockwork-Muse May 31 at 23:22
  • Yes, they could still hash it. I said so in the first paragraph. My guess is that it is not. I can imagine someone saying that by converting it to a numberpad version that that is a form of hashing. – schroeder Jun 3 at 9:03
  • 1
    What makes you think it is "most likely stored in their help desk system without any protections"? – LVDV Jun 3 at 11:13
  • @LVDV experience with Help Desk systems and call center software. Once you type the number into your phone, even if there is an API and everything is properly hashed and salted (which I have not seen), the phone system is likely not securing the input from the phone system. It's stored in the phone system logs. The logs likely have no protections from being read, in my experience. – schroeder Jun 3 at 12:00

Is it a bad sign?
From these questions I've found it seems a standard way of verification that's been available since at least 2012.

How do I use the phone keypad to enter letters from a password instead of numbers when prompted by an automated system?

When talking to Orange and asked to enter password details, can only enter numerals and not letters. What do I do to enter letters?

Does this necessarily mean that they are storing my password in plain text? Shouldn't they be unable to confirm my password over the phone if it was properly hashed?
Not at all. After you enter your password the automated system will request a verification from the security identity tool used by the company and after it returns the OK, the agent you're talking to will receive a notification that they can proceed with your call. This can be a simple REST call over a secured API and it is not necessary to save your password for this to work or have anything be visible to the agent.

There's nothing here that indicates that your password is visible to anyone or being saved in an unsafe manner. These tools are specialized and designed with proper security principles in mind.

  • 1
    The quoted questions or how long ago this type of system has been used do not answer the question of how the passwords are stored. The whole point of the question is to understand how the "security identity tool" verified the password entered via the phone and you do not answer that. And no, this is not the same, security-wise, as entering a password on the website. Converting a password into something that can be reduced to a character set of 10 presents a significant weakening of the password. – schroeder Jun 3 at 9:09
  • @schroeder Thank you for cleaning up my post. I've removed the sentence about it being the same as logging into the site. I can't answer how the tool makes the verification since I don't know which tool is being used. That's why I kept it vague. Verification will be done through secure API's, that's a given this day and age. The entered password is not stored. – LVDV Jun 3 at 9:35
  • 1
    But you don't know, and you are not answering the question. If we reduce your answer to the last 2 paragraphs (because the others do not apply), all you have said is "the system verifies the password - I don't know how". So, it's not a great or useful answer. In my answer, I lay out where I'm guessing and provide the technical points where things may be in plaintext or not. I don't know either, but I provide some technical details to support a hypothesis either way. – schroeder Jun 3 at 9:40
  • 1
    I'm an application and integration developer for ServiceNow. While this is an ITSM tool and not a call system, it is often used for service desks. Tools that allow you to capture keypad entries and feed this to an external system for verification are not designed by amateurs and will be build with security in mind. My second to last paragraph is a simple REST call in layman's terms, it's how I as a professional would do it. – LVDV Jun 3 at 11:16
  • 1
    I get all that, but none of this answers the question – schroeder Jun 3 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.