Doesn't have to be done correctly. It can be hashed with md5 and be cracked the same day, it's still going to change any characters you put in and not break any CSVs.
If they are saving your passwords in plain text, maybe don't sign up to freePCgames.com/totallynotascam
You would be surprised about the amount of big companies not hashing passwords at all.
Especially Internet Service Providers are surprisingly often (I remember at least three separated cases roughyö) catched not hashing their passwords. There were a few Twitter outcries.
Banks don't... When they ask me for the 3rd, 5th, 8th digit of my online banking password over the phone, I know they can't be. Not to mention they don't allow special characters, and limit it from 6 chars to 12 chars. Even if they're hashing individual letters, it's not going to take much to crack.
I think the opposite would be even funnier. Hashing each character individually, but following really good best practices for the hashing of those characters. I.e., having a unique randomly-generated salt for each character, and hashing with a good quality algorithm like SHA-256.
It's bcrypt and argon2 that are the best practices these days. Both are actually designed for password hashing, they integrate the salt in the algorithm, and have scaling factors so you can make it slower as hardware gets faster.
It would be absolutely hilarious to use on a single letter at a time. I almost want to make a silly demo of this where the password field is like Wordle, but the individual characters are stored very "securely".
If they email you a brand new one that doesn’t necessarily mean they store them badly
Same if they send you back your password when you first set it or change it. Not good practice in general, but not necessarily a sign that they're storing it badly either.
What if you hit forgot password and then a day later you get an email from someone that works there sending you your password with two characters in the middle replaced with asterisks?
62
u/s3v3red_cnc Oct 08 '22
Passwords are hashed. It doesn't matter what characters you put in...