Ask HN: A major USA bank is storing passwords in cleartext

Re:Ask HN: A major USA bank is storing passwords in cleartex... by chrismatheson on Tuesday February 18, 2020 @07:53AM (#22355620)

Is it not possible to verify positional characters without storing in plain text ?

off the top of my head, something like storing your full password salted + hashed along side each char salted + hashed.

[ Parent | on HN ]

Re:Ask HN: A major USA bank is storing passwords in cleartex... by benmmurphy on Tuesday February 18, 2020 @08:25AM (#22355836)

If you store an individual character hashed then it is trivial to brute force it. I don't think there is a bcrypt work factor that you could use that would prevent brute forcing but would allow the individual character to be used for authentication.

[ Parent | on HN ]

Re:Ask HN: A major USA bank is storing passwords in cleartex... by mrfredward on Tuesday February 18, 2020 @09:00AM (#22356078)

And if you know the first character of a two character password, it's trivial to brute force the second, and so on...

[ Parent | on HN ]

Re:Ask HN: A major USA bank is storing passwords in cleartex... by chrismatheson on Thursday February 20, 2020 @07:15AM (#22374499)

i would definitely expect it to be less secure, but not exactly plain text?

[ Parent | on HN ]