4 ms·

It could be done on the client if you get them to enter their old and new passwords.

• tzs 10y ago
  If they are going to have a "new not similar to old" policy, it should probably be done on the server rather than the client, because the client is less trustworthy. A password change dialog needs to be asking for the old password anyway and then verifying that it is correct to protect against people who step away from logged in sessions having their passwords changed by pranksters or worse. I doubt "new not similar to old" policies actually accomplish much. If they are implemented securely using standard technology they will only be able to check the proposed new password against the current password. That just means that instead of having a sequence of similar passwords, P1, P2, P3, ..., users will have two such sequences interleaved: P1, Q1, P2, Q2, ..., where all the P's are similar and all the Q's are similar but the P's are not similar to the Q's. There's probably a way to do a similarity check between two passwords given just hashes of the passwords (for instance, using homomorphic encryption), but that kind of thing is more research level than deploy live level, I believe. If/when that becomes practical, then a no similarity policy could go back as far as you are willing to keep old password hashes around without being any less secure than a no reuse policy going back as far.