3 ms·
If the old password is salted and hashed (which it should be), then it is practically impossible to detect when the new password is similar.
by gmfawcett 6y ago
If the old password is salted and hashed (which it should be), then it is practically impossible to detect when the new password is similar.
- Kranar 6y agoOP literally gave a method for how to do it.
- gmfawcett 6y agoUnfortunately it's an easily defeated method. The motivated user just changes their password to a temporary value, and then again to the incremented value.
- bobthepanda 6y agoI've been at places where the old passwords seemed to be kept around, so that it was detected whether or not you were switching to the password you used six or seven passwords ago.
- throwawayboise 6y agoThis is done by keeping the old hashes around. The new password hash is compared to prior hashes to be sure it doesn't match any of them. This only catches exact matches on re-used passwords. Or, the current plaintext password is compared to the new plaintext password (normally a password change requires the current password) so you can do more sophisticated similarity checks, but only compared to the current passord, not any older ones.
- Spooky23 6y agoSome IDM products store the password with symmetric encryption and analyze it. Siteminder is/was one that spooked to mind.
- Kranar 6y agoA user can also trivially defeat any password system by publishing their password to Facebook. The purpose of preventing similar passwords isn't to prevent a user from defeating themselves, it's to prevent an adversary from defeating the user. Now you can rightfully argue that blocking similar passwords isn't an effective measure against an adversary, and this article kind of suggests that... but it is possible to implement such a system.
- gmfawcett 6y agoOf course, you're right that it's possible, and that they have easier ways to subvert the system.
- nearbuy 6y agoTrue, but if someone is really motivated to undermine their own security, I don't think there's anything you can do to stop them. I think the idea is that most users will just choose another password if you tell them the one they entered is too similar to their previous password.
- ixwt 6y agoNot true. If you have the new password, and old salt and hash, you could change a few things in the new password (common things, like increment or decrement a number if there is on the end), and hash it with the old salt. All this would be done when updating the old password.
- gmfawcett 6y agoAh, fair enough, you could do that.
- Jiejeing 6y agoProper password change procedures generally require the old password to update it, so the code running on that page theoretically has access to both and can run a similarity check. But my opinion is that ensuring creative passwords with an unclear similarity rule will only result in creative bypasses of that rule.