3 ms·
Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?
by godshatter 5y ago
Doesn't that imply that the are saving your previous passwords in plain text somewhere instead of saving hashes of them? How is this more secure?
- GuB-42 5y agoUsually, when you change your password, you have to enter your old password. With both plaintexts, the check is trivial. It also means it should be possible to bypass that by changing the password twice or by "forgetting" your old password. Another possibility is that they simply lie to you and the rule that is actually checked is much more permissive. I've often seen requirements that are not actually checked
- dr_kiszonka 5y agoThis would be my guess too. Alternatively, maybe they save hashes of all substrings of length > 2 and check all hashed substrings of the new password against them. (Which - in my limited understanding of infosec - would be only marginally better than plaintext, but I can be wrong.)
- teawrecks 5y agoYeah, having hashes of substrings of a password would help a LOT when brute forcing. If I have a 10 char pass, and I'm storing 1 hash of the full pass + 9 hashes of the 2-char substrings, I can now brute force all those 2-char hashes and then fit them together in the few valid ways they could go together (assuming there is more than 1) until I find the final hash. Salts wouldn't matter.
- deleted 5y ago[deleted]