Linked Questions

69
votes
11answers
9k views

Is there any way my password is hashed, if I'm only ever asked to provide 5 out of many characters? [duplicate]

There is a system that, on a login form, presents about 40 boxes for password letters (to hide password's actual length), and only random ones (the same amount each time) are editable. Explanation is -...
33
votes
6answers
3k views

Does verifying identity by positions in passwords mean passwords are stored unhashed? [duplicate]

If authentication occurs by asking the user for the characters at certain positions in the password (such as: give the 3rd and 7th character in the password), does this imply that passwords are stored ...
19
votes
7answers
3k views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
24
votes
5answers
6k views

Is my bank storing my password in plain text? [duplicate]

My bank (and every bank I've come across) only ever asks for individual characters from my password when logging in. Is my bank storing my password in plain text?
2
votes
3answers
692 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
3
votes
2answers
302 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
1
vote
4answers
184 views

Disallowing new password if it contains sequency of 4 characters present in 10 previously used passwords [duplicate]

I was forced to changed my password to an account (large institution) and it had a rule that the new password cannot contains a series of 4 consecutive characters that were in 10 previously used ...
3
votes
1answer
238 views

How should I store a password to allow people to enter single characters from it? [duplicate]

Possible Duplicate: How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext? Some banking applications ask for random letters from ...
1
vote
1answer
111 views

Using the index of characters in a security question [duplicate]

I'm seeing many sites offering one or two "security questions" that have to be answered by choosing characters at specific indexes, in addition to username + password. For example: "What is your ...
4
votes
0answers
66 views

How does 'Enter characters 1, 3, and 4' from your password work? [duplicate]

My background is in web apps, so when storing a user's password we use a cryptographic hash and salt it so that it is not recoverable. My basic understanding of what is happening is that to check if ...
0
votes
0answers
45 views

Verification on phone first three password characters [duplicate]

I just called my mobile phone provider and they asked me to verify myself by telling them my mobile phone number and the first three characters of the password of my online account. Now I'm wondering ...
77
votes
10answers
26k views

Bank wants my Online-banking PIN through the telephone

My new girocard did not reach me. I wanted to call the bank to block the old and get a new one. So I checked my online banking and found a phone number ("Block card: girocard or visa card lost? Call ...
52
votes
6answers
10k views

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
30
votes
3answers
9k views

How secure is asking for specific characters of passwords instead of the entire thing?

In some password-authenticated sites, you are asked to enter a random selection of specific characters from your password rather than the whole word/phrase. For example, it might say 'Enter the 1st, ...
11
votes
2answers
2k views

Is it bad practice to ask only for individual characters of a password? [duplicate]

Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...

15 30 50 per page