3 ms·
A user could defeat this by changing to an intermediary password and then incrementing the original. E.g. sign in with current password "cat100", change it to
by gmfawcett 6y ago
A user could defeat this by changing to an intermediary password and then incrementing the original. E.g. sign in with current password "cat100", change it to "dog100", then sign in as "dog100" and change to "cat101".
- tshaddox 6y agoThe system can just store the last n passwords (salted and hashed, of course) for each user. I seem to recall some software I had to use in college wouldn’t let you toggle between passwords like this.
- michaelt 6y agoAh, but one could write a script to change password n+1 times. That's why, to encourage users to assume last month's password was compromised, when my users change their password the old password is automatically posted to twitter /s
- unrealhoang 6y agoStoring salted & hashed passwords can only prevent reuse the exact old password, it can't prevent reuse & increase though.
- tshaddox 6y agoUnless you generate all the password variations upfront and salt+hash them all! I think I’ve heard that some place (maybe Facebook?) does this for common password entry mistakes like capitalization.