On: NIST’s new password rules – what you need to know

[stouset]

Replying to sibling.

Worse, if reps can see the answer, then this is equivalent to not hashing the passwords at all since you have a password-equivalent stored in plaintext.

[serge2k → stouset]

FYI, if you click on the <x> minutes ago link above the post you can get a reply box even on new posts.

When I worked for t-mobile it was last 4 of the social unless the customer requests otherwise.

Few requested otherwise, and usually it was because they were annoyed about people being able to see part of their SSN.

[developer2 → serge2k]

>> they were annoyed about people being able to see part of their SSN

Part of? I worked for AT&T back when they merged with Cingular. We only asked for the last 4 over the phone, but the entire 9-digit SSN was shown in the app. Every single low-level employee had (has?) the entire SSN in front of them. Never dared tell a customer that little fact when they made a fuss over my having access to their last 4.