News for hackers. Stuff that matters.
Re:Partial password usability sucks by ajuc on Thursday March 07, 2019 @02:23AM (#19326184)
> It's always sequential.

It's monotonic, but not sequential. On one login you will be asked for positions 1,3,4,7,9, 10, on another you will be asked for letters 1,2,5,6,7,8. Merging such partial information isn't trivial if you don't know which positions you got.

Let's say you have 16-letter password. That's 4 missing letters during each login.

There's (16 over 4) = 1820 possible ways that the characters the keylogger see can be positioned in the real password.

Re:Partial password usability sucks by inetknght on Thursday March 07, 2019 @11:38AM (#19329467)
When computers can generate billions of hashes per second, what makes you think a mere 1820 possible considerations are significant?
Re:Partial password usability sucks by dpark on Friday March 08, 2019 @12:00PM (#19339376)
You get 75% of the letters every time, in order. It's pretty trivial to merge these together after a few examples. Every time you ask for a set of characters, the set of possible outcomes shrinks, and 1820 isn't exactly a large set of possibilities to start with (for your 16-character example).

Given that most people do not use random passwords (and are even less likely to in with a scheme like this), guessing the missing characters is likely trivial for most passwords.

Also the scheme you're describing is very clearly not the one in use here given that they asked for only 4 characters.