Re:Partial password usability sucks
by john-radio on Wednesday March 06, 2019 @02:44PM
(#19322025)
I guess (hope) they just have a collection of patterns that they apply (like (3, 9, 11, 12, 15) from the OP), and when they store your password's hash, they also store the hash of those several characters so that they can present the pattern to you later and check whether you matched the pattern correctly.
[ Parent
| on HN ]
5 characters is "pretty simple to bruteforce" area, and now you've got 5 characters, replicate that for the other patterns, and you can probably crack the whole password pretty easy