Is anyone aware of an algorithm/method that allows me to validate just a few letters (or other characters) from a password. For example, the application asks for the 2nd, 3rd, 6th and 9th letters from the password. Which letters are requested is determined randomly.
I really, really don't want to store passwords in plain text. This technique is used by at least one UK bank.
I this a good idea? Can anyone offer any help? I'm a fairly competent programmer.
When a password is required, the user is prompted to provide a random selection of the characters in their correct positions. This selection might be, say, the 2nd, 3rd, 6th and 9th characters, or might be some other selection, chosen at random. The only feedback that the user gets is "pass" or "fail". He cannot use this to probe each character in the password at his leisure.