3 ms·
The "n previous" is trivial to do with hashes. The problem is the policies like "you can't add a number to a previous password". With those, you must have a rev
by SoftwareMaven 15y ago
The "n previous" is trivial to do with hashes. The problem is the policies like "you can't add a number to a previous password". With those, you must have a reversable password.
Ironically, those policies make you significantly less secure. First, you are storing previous and current passwords in a reversible format. Second, the more difficult your policies, the more likely your users are to treat the password insecurely (PostIt note on the monitor, etc).
- lurker19 15y agoAbsolutely incorrect. The system stores not only the hash of your password, but also the hashes of the forbidden variations, at the moment the initial password is processed.
- SoftwareMaven 15y ago"A password can't begin with another password." (meant to capture password, password2, password3... Are you going to hash every permutation? Seems like an awful lot of disk space. Another policy I've seen is "passwords must differ by at least N characters". Again, how many hashes do you need to store for a 16 character password? For any trivial policy ("don't add numbers to the end", storing the extra hashes will work. All the password policy systems I've seen allow too many axes of freedom for that.