Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
You may be right. I was thinking that the strings would be padded with a random pepper and a unique salt though, before hashing. So the string “sw” might become “swrP86#UlRA64%KGjBICfyO!6” with the unique salt and then “awrP86#UlRA64%KGjBICfyO!6L6ZCf3#T##ssUPjfOMXL^YGZ" with pepper added before hashing, while the string “od” might become "odjaSmh&1$n1##1#400AjQE10kXL6ZCf3#T##ssUPjfOMXL^YGZ” (salt shown in italics). Then you’d be trying to crack these long strings rather than just two-character strings. Of course, if someone steals the DB they would have the unique salt, which would reduce the difficulty to that of guessing two characters plus the pepper (assuming the pepper is stored securely elsewhere), but that’s still quite difficult.