Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.

I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)

Is there any secure way that this could be happening? Or are the companies storing my password in plain text?

  • eating3645@lemmy.world
    51·
    1 year ago

    I always figured they checked the plaintext locally before hashing and sending it to their server, but I don’t really know.

    • snorkbubs@fedia.io
      21·
      1 year ago

      This is it.

      It seems a lot of people have trouble distinguishing between what’s simply happening in their browser, and what’s being sent back to the server. I mean, I get it; it’s confusing, even to the people creating the tech, let alone a casual netizen. It’s a good question, and you can’t fault anyone for wondering what’s what.

      • eating3645@lemmy.world
        3·
        1 year ago

        Yes, asking these questions is a fantastic thing.

        Speaking of questions - I imagine there is a day to use the built in dev tools in the browser to verify that the particular site does this, but I don’t know how. Do you happen to know how I might?

        I remember signing up for a site a few years ago and they emailed me my confirmation, with my password, in plaintext. I was absolutely shocked

        • snorkbubs@fedia.io
          1·
          1 year ago

          Just a heads-up, your comment is posted twice.

          Not sure if there are any browser dev tools that do what you’re specifically asking. It’s more that you need to know what to look for in the source code, and the tools just aid in finding/editing/testing things. Even if you learn a dozen coding languages, and know what to look for, they may be sending the password as plain text and then doing the dirty work server-side. Maybe they send a single-use key to your browser, hash and send the password with that, then re-hash it on the server, with a private key. There are numerous ways to accomplish the task, and I’m glad I didn’t start any arguments with my simplistic “this is it” statement.

          All of that said, I’ve been out of practice for quite a while, and I was never a wizard anyhow. So, maybe someone else can offer a catch-all solution, but I really doubt it. Regardless, being aware and vigilant puts you way ahead of the pack, so nice work there.