Let me ask to experts how bank BBVA and Santander en España can check dedicated digits of my password during call to their hot line? They said me that it is verification procedure but I am not sure it is safe because every call they ask different position numbers of password and their system can test it with some magic! I am not stupid to understand that they store my password without hash form. In addition during verification they sometime asked my DNI which is login to my bank account. Can somebody help me to find how I can find some security government duty to notify them this dramatic situation?
1
-
Does this answer your question? How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?, Is it bad practice to ask only for individual characters of a password?. How secure is asking for specific characters of passwords instead of the entire thing?, Does verifying identity by positions in passwords mean passwords are stored unhashed?– Steffen UllrichAug 26 at 3:26
Add a comment
|