8 ms·
Yep, Its very secure, because nobody would use: P@ssw0rd! P@ssw0rd!2 P@ssw0rd!3 P@ssw0rd!4 P@ssw0rd!5
by briffle 6y ago
Yep, Its very secure, because nobody would use:
P@ssw0rd!
P@ssw0rd!2
P@ssw0rd!3
P@ssw0rd!4
P@ssw0rd!5
- jagger27 6y agoI once used a system that stored old passwords as plaintext and searched for substring repetitions. Horrible.
- rovr138 6y agoMicrosoft has that. Not plaintext, but encrypted (not hashed) with the idea that they can be used for things like that. https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption https://docs.microsoft.com/en-us/windows/security/threat-pro...
- BrandoElFollito 5y agoThis is a good idea, if the passwords are the ones people change *from* (i.e. once you change your password, it gets into that list). This way nobody can use the password anymore (with the idea that it is a weak now, for any reason). This is selfish, though. If that database of passwords leaks, they are prime candidates to test on *other* sites.
- ben0x539 6y agoIf you encrypt the prior passwords using a key derived from the current password, you're enabling this sort of check on password change without really sacrificing security, don't you?
- dragonwriter 6y ago> If you encrypt the prior passwords using a key derived from the current password, How can you do that with a prior password if you didn’t store it as plaintext when it was current? You can’t encrypt something you don’t have. Unless you are encrypting the old hash, not the password.
- eropple 6y agoYou would have it during the password change if you did old-new-new_again, yeah?
- ben0x539 6y agoYeah that was the idea. I guess a lot of apps don't actually do that and just email you password reset links, in which case you can't actually recover the old password. :<
- rovr138 6y agoThis leaks data if a collision can be found and exploited. Assuming the user uses the password in other places, this can be a bad thing.
- dr-detroit 6y agoI am forced by management goons to give human resources database password in plaintext to indian/chinese developers who cannot grok typing a password but their job is sweet and better than mine but whites cant do database work dont be silly. Dont worry hr data isnt institutional only the poor suckers who work here are at risk.
- jnwatson 6y agoThe excellent (or horrible, depending on which end you're on) pam_pwquality[1] module for Linux allows rather fine-grained enforcement of how much a new password must differ from the old password. 1. https://www.systutorials.com/docs/linux/man/8-pam_pwquality/ https://www.systutorials.com/docs/linux/man/8-pam_pwquality/
- merb 6y agowell I've known more clever users, guess what you need to do if your password needs to change every 90 days, but you need to have a different password for at least 5 cycles? correct, you do it like that: - h@se2003 - h@se2006 - h@se2009 - h@se2012 - h@se2103 - h@se2106 you get the point ;-) bonus points for encoding the username into it and making it a thing for the whole company, yeah very secure!
- corobo 6y agoThis is how I used to do it. Just slap the year and Q on the end whenever it wanted me to change it. End of the quarter gets a bit tricky if things don't line up but it's mostly muscle memory by then Sup3rdup3rp4ss2021Q2
- 001spartan 6y agoThat's why those of us in the security industry have to say "compliance is not security" whenever PCI is brought up.
- xtracto 6y agoPCI is just so asinine it made me want to poke my eyeballs out when I had to go through it (Level 1 Service provider). In some situations it actually prevents you from being more secure. One of the reasons why I want the Credit card cartels to die.