Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
I always figured they checked the plaintext locally before hashing and sending it to their server, but I don’t really know.
that doesn’t explain the scenario described in the post
You’re right, I misread the post. What sites have done that? I’ve been fortunate to never encounter any.
A bunch of European banks.
Might be time to switch banks…
They all do it. It’s perfectly secure if you don’t implement it in a naive way.
No, they aren’t storing your password in plaintext.
How is it implemented?
There’s a security stack exchange on this exact question here.
Storing your credentials in plaintext would be insane, illegal, and would never pass any kind of audit.