Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
I’ve only seen this as a second factor after entering a full password. Although it has mostly been replaced by actual 2FA now. Last time I remember this type was on the uk gov student finance website
The 2 occasions I can think of, it was characters from my main password. Both were during contact with the Support teams. I no longer have service with either of the companies (due to unrelated reasons)
Did you have to give those characters directly to the support staff?
On one occasion, yes, over the phone.
The other I was in a web chat on the company’s website and they provided a link to a page on the same website where it asked for the characters
Even if they somehow manage to secure the password properly while still being able to know a specific character from that password, having support staff handle that information directly seems very very fishy. All in all, it doesn’t speak for their security practices. Even if they have sone form of protection for the specific characters stored separately, it would reduce the overall security because parts of your passwords are more easily guessable. In the worst case they simple store your pw in plain text and on top of that they might supply that information to the support staff.