3 ms·

what if the password needs to be changed and previous ones can't be reused (You then must remember that)?

ethbr0 3y ago
That's a use case for the good 'ole iterated number! Eventually you roll off the end of the history check, and can reuse the original on the next iteration. In my practical experience, I've never had a site where this happens with an account lock on bad password aggressive enough to lock me out before I find the iteration I'm on.
tjoff 3y ago
Then for such sites you add the date, maybe in the form of [year][password][courter]. Probably modified somewhat so it isn't obvious what is is.
- NikkiA 3y ago
  This reminds me of a time I was working for a company that motorola contracted, they sent us a system to install some software on, but forgot to set the root password to something shared with us. When told, they said 'sigh you'll have to ship it back to us so we can passwd it, then ship it back, even though our passwords are system specific and changed frequently - telling you the password would expose our password choice algorithm' We theorised it was probably "AlorotoMAug"
- mgfist 3y ago
  A number of sites don't allow you to reuse iterations of old passwords (not sure exactly, but perhaps can't have more then 4 repeating chars). So you can't simply append, you have to change the actual password a considerable amount. Had a few websites like that, they were the bane of my existence until I got a password manager.
  - tjx 3y ago
    That's a serious security risk if a website knows your older password and you're newer password is just one character different than the older one. old: year-password-counter (23supassword1) new: year-password-counter++ (23supassword2) If website tells you that you cannot use your new password, then it screams that they're somewhat storing/accessing the old password. If they're storing just the hash, there's NO way it could have been detected. (Unless they take your new password and then check from a-z0-9 last characters, convert to its hash and then compare with old password hash) but in my entire IT Security career, I have never seen it doing anywhere.
    - mgfist 3y ago
      It absolutely is. It was my university website so couldn't avoid it either.

That's a use case for the good 'ole iterated number! Eventually you roll off the end of the history check, and can reuse the original on the next iteration. In my practical experience, I've never had a site where this happens with an account lock on bad password aggressive enough to lock me out before I find the iteration I'm on.

tjoff 3y ago

Then for such sites you add the date, maybe in the form of [year][password][courter]. Probably modified somewhat so it isn't obvious what is is.

NikkiA 3y ago
This reminds me of a time I was working for a company that motorola contracted, they sent us a system to install some software on, but forgot to set the root password to something shared with us. When told, they said 'sigh you'll have to ship it back to us so we can passwd it, then ship it back, even though our passwords are system specific and changed frequently - telling you the password would expose our password choice algorithm' We theorised it was probably "AlorotoMAug"
mgfist 3y ago
A number of sites don't allow you to reuse iterations of old passwords (not sure exactly, but perhaps can't have more then 4 repeating chars). So you can't simply append, you have to change the actual password a considerable amount. Had a few websites like that, they were the bane of my existence until I got a password manager.
- tjx 3y ago
  That's a serious security risk if a website knows your older password and you're newer password is just one character different than the older one. old: year-password-counter (23supassword1) new: year-password-counter++ (23supassword2) If website tells you that you cannot use your new password, then it screams that they're somewhat storing/accessing the old password. If they're storing just the hash, there's NO way it could have been detected. (Unless they take your new password and then check from a-z0-9 last characters, convert to its hash and then compare with old password hash) but in my entire IT Security career, I have never seen it doing anywhere.
  - mgfist 3y ago
    It absolutely is. It was my university website so couldn't avoid it either.