Basic cyber security says that passwords should be encrypted and hashed, so that even the company storing them doesn’t know what the password is. (When you log in, the site performs the same encrypting and hashing steps and compares the results) Otherwise if they are hacked, the attackers get access to all the passwords.
I’ve noticed a few companies ask for specific characters of my password to prove who I am (eg enter the 2nd and 9th character)
Is there any secure way that this could be happening? Or are the companies storing my password in plain text?
It’s not necessarily bad practice, that’s exactly how such a system should work, assuming the keys material is good enough not to be brute forced easily. SSS is better if you combine strong key material (actual cryptographic keys, for example) but reading out ECDSA keys over the phone is quite the hassle.
I’ve never actually encountered a business that asked for my password over the phone and I would feel sketched out regardless of how good their implementation might theoretically be. It’s better than voice identification, but I’d rather keep my passwords to myself.