Hacker News Reader

Comment by nrki | Hacker News Reader

This is pretty standard for UK banks.

They'd do a hash of each character of the password (in Lloyds' case, your "memorable word" combo), to compare your entries to.

View on HN

Wait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every option if you only have a hash of the full password, but only 10*26 = 260 attempts to test every option for every individual character.

I have to use two passwords to login to Lloyds bank. One conventional password (which is presumably stored salted and hashed) and one where I have to enter characters from three positions they choose. The latter is intended to mitigate the risk of using your account from a vulnerable computer. The former takes care of vulnerabilities on their end (as far as any password can).

Could they implement something like:

Password: money

Secret word: ABCD

If they're going to ask for two characters from the secret word, they could then hash

  saltmoneyAB
  saltmoneyAC
  saltmoneyAD
  saltmoneyBC
  saltmoneyBD
  saltmoneyCD

and check against the relevant one.

I may be incorrect on the "hash each letter individually" part. But this is combined with a password.

Reply on news.ycombinator.com