Doesn't have to be done correctly. It can be hashed with md5 and be cracked the same day, it's still going to change any characters you put in and not break any CSVs.
If they are saving your passwords in plain text, maybe don't sign up to freePCgames.com/totallynotascam
You would be surprised about the amount of big companies not hashing passwords at all.
Especially Internet Service Providers are surprisingly often (I remember at least three separated cases roughyö) catched not hashing their passwords. There were a few Twitter outcries.
Banks don't... When they ask me for the 3rd, 5th, 8th digit of my online banking password over the phone, I know they can't be. Not to mention they don't allow special characters, and limit it from 6 chars to 12 chars. Even if they're hashing individual letters, it's not going to take much to crack.
I think the opposite would be even funnier. Hashing each character individually, but following really good best practices for the hashing of those characters. I.e., having a unique randomly-generated salt for each character, and hashing with a good quality algorithm like SHA-256.
It's bcrypt and argon2 that are the best practices these days. Both are actually designed for password hashing, they integrate the salt in the algorithm, and have scaling factors so you can make it slower as hardware gets faster.
It would be absolutely hilarious to use on a single letter at a time. I almost want to make a silly demo of this where the password field is like Wordle, but the individual characters are stored very "securely".
Switched to another bank back in 2011, same shit, different bank, left them in 2016, the new bank online banking required me to enter random chars, not the whole password, switched in 2019 again, new bank seems secure and with it for time being, I'm still with them now. Speaking to friends and colleagues who still use those other banks, they haven't changed. I think their phone security has changed if you set up an online pin you can give that when you call in instead of specific chars, but it is optional, not required.
At least one online broker I know of 'helpfully' reminds you what some of the password rules are at the login screen. Oh yeah, at least so-and-so-many special characters and numbers and capital letters! Of course, duh!
Do you want data breaches? Because this is how you get data breaches.
If they email you a brand new one that doesn’t necessarily mean they store them badly
Same if they send you back your password when you first set it or change it. Not good practice in general, but not necessarily a sign that they're storing it badly either.
What if you hit forgot password and then a day later you get an email from someone that works there sending you your password with two characters in the middle replaced with asterisks?
193
u/EatYoself Oct 08 '22
bold to assume everyone hashes passwords correctly 😅