Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
Theoretically they could hash the the two characters with a salt and store it that way, but extremely unlikely they’d actually do that. And also fairly pointless. But still technically possible.
I wrote a comment about this in this thread. Just to add that a salt doesn’t add complexity to the brute forcing of a password, it just makes it so you need to brute-force each one separately.
Hashing pairs of characters would be extremely insecure.