I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account on their website, not a special password for use over the phone. The fact that they know what th...
Perhaps they stored the fourth and fifth characters of the password when you set it. That would also reduce the security of your account, but not by as much as storing the entire password in recoverable form.
Regardless of what the legal side of this is, you should report them to plaintextoffenders.com. Even if it is encryption or what Phoog mentioned, its pretty bad and they should be pressured to switch
There are various technological approaches to this which don't involve the password being in plain text or even protected by reversible encryption, so its entirely possible their implementation meets the GDPRs requirements.
You have no proof whatsoever that they store the password in a form different from a hash. When you change your password they can easily create two hashes: 1) the hash of the whole password and 2) the hash of just the 4th and 5th characters and the operators can check the 4th and 5th character using this second hash. Sure, this hash can be easily brute forced independently of the load factors of the hashing function but your assumption that they must store the password in a form different from a hash is simply false
Regardless of whether they are, this is a very low-impact account/issue for most people. There is very little information, most of it not sensitive, protected by the password, and leak of it is mostly a DoS risk (somebody maliciously interfering with the availability of your service, e.g. shutting it off).
@GiacomoAlzetta, I agree with your comment except about easy brute force of the second hash. It seems to be used only with voice calls, so any exhaustive search would be immediately witnessed by the ISP rep on the phone.
@GiacomoAlzetta Unless the ISP asks for only the 4th and 5th characters, in that order, they would have to store hashes for all combinations of two characters from the password. If the password was mandated to be exactly 10 characters, that would mean storing something like 90 hashes per password (it could be more, I may have missed some). I suggest that that is unlikely ;)
@AndrewMorton Yes, but if the password is limited to 10 characters, then storing those 45 (not 90) hashes is just as bad as storing the password in plain text, because the hash of a two-character string is very fast to break.
@DawoodibnKareem I did not look into it very closely. Is it still 45 if "ab" is different from "ba"? (Although we don't need to know how many angels fit on the head of a pin.)
Well yeah, the hash of AB really should be different from the hash of BA. But if the whole point is so that the call centre worker can check what you say is the fourth and fifth characters of your password, it doesn't help them to also have a hash of the fifth and fourth characters.
@AndrewMorton Nothing in what the OP is saying suggests that they ask for any pair of characters. As I said they can decide to always use the 4th and 5th character as a simple check of authenticity and this can be done by just using hashes. donjuedo An hash of 2 characters requires at most 65k attempts and probably << 2500 attempts to bruteforce it. So even using a slow hash that takes 1 minute to compute in 45 days you'd find the correct pair of chars (and the hash will probably take < 1 second...) Once you have these 2 characters you also have a easier time BFing the whole password.
How do you know they're not hashing it? I worked in IT for a bank that does this and they do hash the entire password, but using a reversible algorithm. The GDPR does not state passwords have to be hashed.
Discussion on question by fluidj: ISP…
Discussion on question by fluidj: ISP…