Hacker News Reader

NatWest is also guilty of storing passwords in plain text: their login page says 'enter the 5th, 8th and 12th character of your password'

View on HN

Who's to say they haven't just hashed each individual character of the password?

Does that offer any real protection? I could try each possible character until I find the hash.

You are correct. He was joking

If you're storing individually hashed characters:

a: 0CC175B9C0F1B6A831C399E269772661

b: 92EB5FFEE6AE2FEC3AD71C777531578F

c: 4A8A08F09D37B73795649038408B5F33

etc.

then this is basically the same as storing the plaintext characters because as long as you know the hashing algorithm you can generate a pretty small map of hash -> original character and convert back.

To be fair we can't be 100% sure of that. It is possible they simply hash all the combinations they are going to show you. Could also be stored in an HSM making it a bit more secure.

Reply on news.ycombinator.com