4 ms·
I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let yo
by obelos 7y ago
I used to have to deal with an enterprise system that required quarterly password changes. The interesting thing about this system was it would refuse to let you set a new password that wasn't sufficiently different from the previous several passwords... Which almost certainly means they were implementing this security measure by storing the passwords in plaintext on the server.
- _ah 7y agoYou could take the first N characters of the password and store that as a secure hash. That would catch people choosing password1, password2, etc (but wouldn't help much with 1password, 2password...)
- cgriswald 7y agoStrip all the non-letter characters and hash that.
- deleted 7y ago[deleted]
- pnako 7y agoNot necessarily. You could try simple variations of every single character of the password (lower/uppercase, previous/next character) and try to hash that and compare to the previous passwords. That's just ~30 hashes for a 10 letter password.
- Spooky23 7y agoNot always. Some enterprise tools use symmetric encryption.
- namibj 7y agoThere are locality-preserving hash functions. The typical case is rather non-cryptographic, but there are ways to trade optimal locality parameters against cryptographic security. Also one could use a bloom filter to keep track of the passwords that were used, and have it alert if the to-be-set password can be permutated with some given rules into a password the bloom filter matches. As soon as it matches, you can then do an expensive check against the old salted password to weed out false-positives.