Linked Questions
10 questions linked to/from How secure is asking for specific characters of passwords instead of the entire thing?
11
votes
2
answers
3k
views
Is it bad practice to ask only for individual characters of a password? [duplicate]
Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
- 237
1
vote
1
answer
106
views
password prompt security feature [duplicate]
Got this when requested to enter my password. How is something like this enhancing security ? Is it each time taking random set of index locations and compare it's hash against a database?
- 1,498
4
votes
0
answers
47
views
Is there any merit to only asking for part of a user's password? [duplicate]
The HSBC UK online banking website has a strangely convoluted login system that I haven't seen anywhere else before, and which I'm concerned is ineffectual and compromises security. It works like this:...
- 337
68
votes
6
answers
16k
views
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case.
When I sign on to my online banking account, I'm prompted ...
- 1,061
25
votes
5
answers
7k
views
Is my bank storing my password in plain text? [duplicate]
My bank (and every bank I've come across) only ever asks for individual characters from my password when logging in. Is my bank storing my password in plain text?
- 1,455
5
votes
3
answers
571
views
Are there any regulations against financial companies storing passwords in plaintext?
A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad.
I know this because when you click "Forgot your password?" (or similar) link, it ...
- 822
4
votes
2
answers
577
views
Does a random set of secondary passwords add any security?
My bank uses this rather uncommon policy of authentication. They of course have a password, which has quite strong password patterns like "use alphanumeric characters and symbols, 8+ characters" are ...
- 805
-1
votes
1
answer
191
views
ICloud and Quality Password [duplicate]
How many 'random' characters should my iCloud password be if it were going up against the BEST hackers and the best hacking software?
- 3
4
votes
0
answers
69
views
How does 'Enter characters 1, 3, and 4' from your password work? [duplicate]
My background is in web apps, so when storing a user's password we use a cryptographic hash and salt it so that it is not recoverable.
My basic understanding of what is happening is that to check if ...
- 261
2
votes
0
answers
50
views
How is password character validation in 3D secure is implemented? [duplicate]
We have a website which stores hashed passwords in the database. During logins we hash the password entered by user and compare two hashes. This is quite standard so far. Our client which is in ...
- 121