Hacker News Reader

Ouch! This means that they are storing your original password in plaintext somewhere, and that is definitely NOT best practices!

Maybe it's only a hashed version of the characters? :P

They may be storing the three characters as a hash separately, not that that is much better.

So I just need a pre-hashed table of all 80 possible single chars for a lookup table?

That is worse than a hash of SSNs.

You check 3 characters, not 1, but like I said, 80^3 still isn't good.