Comment Re:Hah! Take that, my bank! (Score 2) 497
The real question is how were they able to truncate your password if they used a hash?
It's not impossible. Let's see one of possible scenarios when a user sign in using his/her long password:
(1) On the server side, generate the hash from user's input and check if it is matched with the stored hash in the database.
(2) If it is matched, continue the sign in process, and truncate the long password: take the first 16 chars of the long password input by the user, generate a new hash, update the old one, set a certain flag if necessary so that in the future only 16 chars are used to generate the hash to validate the login.