Storing users passwords

I am currently designing a system that involves customer logins.  One possible login step is entering 3 random chars from the password.

I know typically. passwords are stored as a hash.  However, it is impossible to use 3 random chars with this method.  Can anyone tell me how the passwords should be stored without storing them as plain text?
Who is Participating?
Rich RumbleConnect With a Mentor Security SamuraiCommented:
So you want "Two-Factor" authentication... there are a number of ways to do this. While it's a good second measure, with phishing and man-in-the middle, it's not a guarantee, but I feel it adds to the security somewhat. I recommend reading:
For your system to ask for 3 random characters from the users password, it should, naturally ask for those first, and the password second. You can store a password in a reversible encryption, and there are other novel methods people are trying for two-factor auth, similar to "captcha" those squiggly text boxes no human can read:
Automated systems are better at solving those than we are, but they have more trouble with questions, like
what is two + 2? or this is a picture of an... "owl" this was made more popular by "kittenauth" where you pick the pictures of kittens
> .. to use 3 random chars with this method.
no, except brute force
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.