Comment by thehappypm

That's not necesarily true. They could store a full password hash and a hash of the 4th and 17th character separately.