I'm assuming they're plain text. There's is no perceivable way they can only use those data points to to figure out which hash it is. Unless of course they're using their own "hashing" function which isn't secure at all since it's probably reversible.
this post was submitted on 11 Jul 2023
83 points (100.0% liked)
No Stupid Questions
35907 readers
2029 users here now
No such thing. Ask away!
!nostupidquestions is a community dedicated to being helpful and answering each others' questions on various topics.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must be legitimate questions. All post titles must include a question.
All posts must be legitimate questions, and all post titles must include a question. Questions that are joke or trolling questions, memes, song lyrics as title, etc. are not allowed here. See Rule 6 for all exceptions.
Rule 2- Your question subject cannot be illegal or NSFW material.
Your question subject cannot be illegal or NSFW material. You will be warned first, banned second.
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Questions which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding META posts and joke questions.
Provided it is about the community itself, you may post non-question posts using the [META] tag on your post title.
On fridays, you are allowed to post meme and troll questions, on the condition that it's in text format only, and conforms with our other rules. These posts MUST include the [NSQ Friday] tag in their title.
If you post a serious question on friday and are looking only for legitimate answers, then please include the [Serious] tag on your post. Irrelevant replies will then be removed by moderators.
Rule 7- You can't intentionally annoy, mock, or harass other members.
If you intentionally annoy, mock, harass, or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here.
Credits
Our breathtaking icon was bestowed upon us by @Cevilia!
The greatest banner of all time: by @TheOneWithTheHair!
founded 1 year ago
MODERATORS
Theoretically they could take those two characters + a salt and then also store that hash. So there it is technically a way to do it although it'd be incredibly redundant, just ask for the actual password at that point.
Please don’t do that. Brute force attacks are very easy on single characters, even two of them.
Yes, I did a reply about this above because this idea has been suggested a few times and it's truly a bad security move. I'd prefer they just encrypted it and made sure the key was stored separate from the database. That's more secure than this idea.
Perhaps they validate the passwords client side before hashing. The user could bypass the restrictions pretty easily by modifying the JavaScript of the website, but the password would not be transmitted un-hashed.
It is worth pointing out that nearly any password restriction like this can be made ineffective by the user anyway. Most people who are asked to put a special character in the password just add a ! to the end. I think length is still a good validation though and it runs into the same issue @[email protected] is asking about
How would they validate individual characters client side? The set password is on the server.
load more comments
(2 replies)
They could hash the xth letters in a seperate column that are hashed separately, but it's likely they are just storing plain text.
I have never heard of anything secure doing that. Assuming they have taken security steps, it would mean they recorded those characters in plaintext when you set your password, but that means that at least those characters aren't secure, and a breach means some hacker has a great hint.
When the hashing occurs, it happens using the code you downloaded when you visit the site, so it's your computer that does the hash, and then just the hash is sent onwards, so they can't just pull the letters out of a properly secure password.
A secure company would use two-factor authentication to verify you above and beyond your password, anyway, since a compromised password somewhere else automatically compromises questions about your password.
A lot of banks in the UK do it. They normally have a secondary pin that they will ask for 2 or 3 characters of.
This means that if you log in and get keylogged/shoulder surfed etc they don't get the full pin. The next time you login you will get asked for different characters.
Not great, but not awful either - going away now that 2fa is more common
A secondary pin is a bit better but characters from the actual password (that you have to enter anyway) adds nothing to security from that kind of intrusion.
load more comments
(2 replies)
load more comments
(3 replies)
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
They what?!
This is a huge red flag and should not even be possible for your primary password, if they are following basic security principles. Are you sure this isn't a secondary PIN or something like that?
NatWest in the Uk does it for both the password and the pin, has been since I signed up like 10 years ago. I assumed they do it so you don’t enter a full password that someone could access later. No idea how they work out but they are big and I assume if it was insecure they’d have had issues by now. I assume they store the letter groupings in advance.
I assume if it was insecure they’d have had issues by now.
At this point, it's okay to assume that they have had issues and they haven't disclosed them.
load more comments
(4 replies)
I would assume they have the whole password in plain text, then. Not much you can do about it, just make sure you're not re-using any part of that password for other services. And if you are, then you should start changing them all to something unique, ideally with a password manager like Keepass or BitWarden. This is a good habit anyway, because you can never really know how companies are handling their IT security.
Crazy that that hasn’t become an issue for them yet! Thanks for the tips! I used to be pretty bad with my passwords but I’m reformed and using KeePass for everything these days.
One of the greats back on r/TalesFromTechSupport had a story about how his company (a telco, iirc) did the following with passwords:
- Discard everything after the 8th character.
- Replace everything that isn't a number or unaccented letter with the number 0.
- Store this "hash" in plaintext.
A user could have a password that they thought was "štr0ng&longsupermegapasswordofdoom" and be able to log in with it, but what was stored was "0tr0ng0l" and they would have been able to log in with something like "!tröng$lips" as well.ä
None of this was communicated to the customers.
Obviously, once in a while a customer would call support because they were sure they had made a mistake entering their password but were able to log in anyway. And tech support had strict instructions to gaslight those customers that they must have entered the password correctly and just thought they made a mistake.
Hot damn 🙈
Do they always ask for the same characters? I'd imagine they could hash the password as well as saving only the 2nd and 9th characters as plaintext. Still a bit of a security risk but not nearly as bad
Theoretically they could hash the the two characters with a salt and store it that way, but extremely unlikely they'd actually do that. And also fairly pointless. But still technically possible.
load more comments
(1 replies)
load more comments
(1 replies)
Good question. A lot of banks in Europe use this type of setup, where it will ask you for 3-4 characters of your pin/password, both to login and to confirm transactions. I always thought it was weird but never thought about the security implications.
load more comments
(1 replies)
I always figured they checked the plaintext locally before hashing and sending it to their server, but I don't really know.
This is it.
It seems a lot of people have trouble distinguishing between what's simply happening in their browser, and what's being sent back to the server. I mean, I get it; it's confusing, even to the people creating the tech, let alone a casual netizen. It's a good question, and you can't fault anyone for wondering what's what.
Yes, asking these questions is a fantastic thing.
Speaking of questions - I imagine there is a day to use the built in dev tools in the browser to verify that the particular site does this, but I don't know how. Do you happen to know how I might?
I remember signing up for a site a few years ago and they emailed me my confirmation, with my password, in plaintext. I was absolutely shocked
load more comments
(1 replies)
that doesn't explain the scenario described in the post
You're right, I misread the post. What sites have done that? I've been fortunate to never encounter any.
One of the main differences between hashing and encrypting is that encryption is réversible by some means, while hashing isn't. The irreversibility is what makes it so ideal for storing a password in a way that definitely can't be used to get the original password back, even if someone steals the whole database with the passwords in it.
Those companies that ask for specific characters might be encrypting the passwords, but they definitely aren't hashing them.
They could hash pairs of characters on password creation and store those. Seems like more data points to guess the original password, but maybe the math is hard enough it doesn't do much.
load more comments
(6 replies)
There's a security exchange thread on it here
It looks like there are certain kinds of algorithms you can run that give you this property.
Also, I've seen this when you have an alternate form of authentication like a password you type in full, or an existing session token. In those scenarios, you could probably use some sort of symmetric key encryption to encrypt the secondary password with the primary password / session token in such a way that you aren't storing the key and can't decrypt it, but that you can check specific digits on command.
Full-stack dev here, not necessarily in answer to OP’s question, but in my experience it is a pretty standard practice that when you log in to a service, the web page sends your unhashed creds to the server, where your password is then hashed and compared to the stored hash. Via HTTPS/TLS/SSL, this is a reasonably secure practice since the creds are still encrypted while in transport. Hashing is a computationally expensive process that (before the advent of WASM) wasn’t really feasible to do on the client side.
What is WASM ?
Web Assembly. Pretty neat tech if you read up on it.
This is typically used for a secondary authentication factor in most instances, such as a service ID number after you've already provided a username, and entered at the same time as a password.
It is not possible for them to securely be storing the password yet being able to retrieve individual characters at the same time.
The way I’ve seen this done before, it was not for a password, but for a token entered after the password was entered. No, the token is not encrypted, and therefore it would not be secure for the service to use it as a password.
view more: next ›