3 ms·
I'm disappointed but not surprised. When I had to change my password a few months ago on the Sony developer's network site I was told that my new password was t
by maximilianburke 16y ago
I'm disappointed but not surprised. When I had to change my password a few months ago on the Sony developer's network site I was told that my new password was too similar to the last ones. I was wondering how they knew that, aside from storing the passwords in plain-text, something I'd assume they'd be too smart to do.
I guess I gave them too much credit.
- phaylon 16y agoGenuine Question: They let you change your password without having you supply the old one?
- jimktrains2 16y agoPassword reset link?
- phaylon 16y agoThat might explain it.
- caf 16y agoWell, they could try permuting your new password in a few different ways and seeing if any of those permutations match the old hash.
- JoachimSchipper 16y agoThat's not practical. Password hashes should be slow, to stop dictionary attacks; and it's easy to imagine a couple thousand "similar" passwords (flip case of some characters? 256 possibilities for an 8-character password. Add year of birth? 20-50 possibilities. And so on.)
- caf 16y agoPresumably the ratio between the rate of normal logins (each of which requires a single execution of the password hash) and the rate of password changes is at least a few thousand.
- JoachimSchipper 16y agoSure, but if you run through a few thousand hashes to check for similarity, an attacker can check for the couple thousand most popular passwords in the same amount of time. It is possible to throw enough money at it to make an attack uneconomical, but that's expensive. (Also, DoS. Note that you can't stop people from changing passwords when the system is under load, as that sets you up for a combined compromise-password-hashes-then-DoS attack...)