5 ms·
Unfortunately it's an easily defeated method. The motivated user just changes their password to a temporary value, and then again to the incremented value.
by gmfawcett 6y ago
Unfortunately it's an easily defeated method. The motivated user just changes their password to a temporary value, and then again to the incremented value.
- bobthepanda 6y agoI've been at places where the old passwords seemed to be kept around, so that it was detected whether or not you were switching to the password you used six or seven passwords ago.
- throwawayboise 6y agoThis is done by keeping the old hashes around. The new password hash is compared to prior hashes to be sure it doesn't match any of them. This only catches exact matches on re-used passwords. Or, the current plaintext password is compared to the new plaintext password (normally a password change requires the current password) so you can do more sophisticated similarity checks, but only compared to the current passord, not any older ones.
- Spooky23 6y agoSome IDM products store the password with symmetric encryption and analyze it. Siteminder is/was one that spooked to mind.
- Kranar 6y agoA user can also trivially defeat any password system by publishing their password to Facebook. The purpose of preventing similar passwords isn't to prevent a user from defeating themselves, it's to prevent an adversary from defeating the user. Now you can rightfully argue that blocking similar passwords isn't an effective measure against an adversary, and this article kind of suggests that... but it is possible to implement such a system.
- gmfawcett 6y agoOf course, you're right that it's possible, and that they have easier ways to subvert the system.
- nearbuy 6y agoTrue, but if someone is really motivated to undermine their own security, I don't think there's anything you can do to stop them. I think the idea is that most users will just choose another password if you tell them the one they entered is too similar to their previous password.