3 ms·

How many people do things like changing their password from "soccer5" to "soccer6" every three months?

• ams6110 16y ago
  That's avoided by not allowing more than three consecutive characters from the old password to be in the new password. It gets really annoying, trust me.
  • pjscott 16y ago
    That would mean that they're storing the passwords themselves, hopefully encrypted, rather than just a salted slow hash of them. That makes me nervous. Should it?
    • gommm 16y ago
      you could have a form asking for the previous password and the new password... It then checks the previous password against the salted hash and then has the information to compare changes between the old password and new password without having to store anything
      • gjm11 16y ago
        Then you[1] can just alternate between two sequences of passwords: password1, cleverme1, password2, cleverme2, ... [1] Meaning: anyone who wishes to use the service but isn't willing to come up with an unending stream of genuinely different passwords for it.