[TeMPOraL]

Or they could generate say, 10 masks, hash them along with the password and then only present you with one random mask from those 10.