3 ms·
> Because password hashing makes it impossible to retrieve the original password, there is no way to guard against people just using a basepassword and appendin
by ajuc 6y ago
> Because password hashing makes it impossible to retrieve the original password, there is no way to guard against people just using a basepassword and appending some type of counter to it.
Almost all the implementations require the old password when you change it to the new password, so it's trivial to check if they are too similar.
def changePassword(login, cleartextOld, cleartextNew):
if too_similar(cleartextOld, cleartextNew):
return new Error("too similar")
hashOld = hash(cleartextOld)
hashNew = hash(cleartextNew)
if authorized(login, hashOld):
setPassword(login, hashNew)
return new Ok();
If you're afraid of sending cleartext passwords - do the too_similar check on the client side. The users that can write their own client to bypass client-side checks are exactly the users you don't need to worry about.
- gmfawcett 6y agoA user could defeat this by changing to an intermediary password and then incrementing the original. E.g. sign in with current password "cat100", change it to "dog100", then sign in as "dog100" and change to "cat101".
- tshaddox 6y agoThe system can just store the last n passwords (salted and hashed, of course) for each user. I seem to recall some software I had to use in college wouldn’t let you toggle between passwords like this.
- michaelt 6y agoAh, but one could write a script to change password n+1 times. That's why, to encourage users to assume last month's password was compromised, when my users change their password the old password is automatically posted to twitter /s
- unrealhoang 6y agoStoring salted & hashed passwords can only prevent reuse the exact old password, it can't prevent reuse & increase though.
- tshaddox 6y agoUnless you generate all the password variations upfront and salt+hash them all! I think I’ve heard that some place (maybe Facebook?) does this for common password entry mistakes like capitalization.