It'll be less secure.

If they hash a subset, then those extra characters are literally irrelevant, since the hash algorithm will exclude them. Like if they just hashed the first 5 characters, then "passw" is the same as "password" and all those permutations. Hashing is safe because it's one-way, but simple testing on the hashing algorithm would reveal certain characters don't matter.

Protecting a smaller subset of characters in addition to the whole password is slightly better but still awful. Cracking the smaller subset will be significantly easier using rainbow tables, and literally gives a hint for the whole password, making a rainbow table attack significantly more efficient. Protecting the whole thing (with no easy hints) is way more secure.

It also adds nothing to keylogging, since it's not even a new code, it's part of the password.

There was a time where that level of security was acceptable, and it still could be ok on a closed system like an ATM, as the other reply to my comment pointed out, but this kind of protection on a standard computer is outdated and adds holes.

A secondary pin is a bit better but characters from the actual password (that you have to enter anyway) adds nothing to security from that kind of intrusion.

It's a problem, but a pretty funny one, to me. Mine does the same thing, startup is full rainbow, then it settles.

I have never heard of anything secure doing that. Assuming they have taken security steps, it would mean they recorded those characters in plaintext when you set your password, but that means that at least those characters aren't secure, and a breach means some hacker has a great hint.

When the hashing occurs, it happens using the code you downloaded when you visit the site, so it's your computer that does the hash, and then just the hash is sent onwards, so they can't just pull the letters out of a properly secure password.

A secure company would use two-factor authentication to verify you above and beyond your password, anyway, since a compromised password somewhere else automatically compromises questions about your password.

At least most of that can be turned off in settings somewhere.

Bought a neat closed-loop watercooling cpu heatsink that has a whole dang programmable screen on it if I pay a monthly thing, or solid colors if I don't. defaults to cycling through the rainbow. But it has an off mode, so I'm A-OK with none of that.

You can go into your account and under two-step, generate a one-time code. Store that code somewhere secure, like a note in your password manager if you trust it with both steps, and you can do it.

Pretty sure Google authenticator will have something equivalent but likely more secure, but haven't used it.

I'd pass it on to someone younger than you. You didn't benefit, the tradition/luck was upheld, seems like the best answer here.

Morally that makes you all squared up, although legally you still accepted it, so this advice is only good if you know you could get away with accepting money, since this sounds like you visit this guy as part of a job.

It's not in that same section, but I find pretty much everything but coffee and tea lists the amount near it.

Purchase history would just be what apple knows, not your general purchase history.

If you use Apple Pay, for instance, they're the middleman and have to know, and anything you buy on the App Store.

A legitimate reason to share that is a budgeting app. Facebook is taking advantage of that, obviously, but in this instance, I see no fault from apple, here, there's reason to allow an app to get that, so an app can request it, and we can deny it by not getting that app, so fuck Facebook, I'm not downloading it.