Ah, this would be the same Fidelity that within the last five years limited users to 12 character passwords?
> Yes ... They’re not morons.
That seems debatable.
I wasn't on the teams handling security, account login / access, etc so I can't speak to specific implementations (nor would I), but the folks I interacted with were super sharp.
Salted? Just once? Or through something like bcrypt or scrypt? Because just salting nowadays is pretty much useless.
You're thinking of multiple rounds of hashing, designed to increase the computation cost of the hashing. For example Bcrypt has a built in cost factor. While this is definitely important it's not quite the same as salting.