3 ms·
The sub-password "similarity" rules (#8) mean that it is incredibly unlikely that the system is storing the password history hashed, and basically impossible th
by jonamato 14y ago
The sub-password "similarity" rules (#8) mean that it is incredibly unlikely that the system is storing the password history hashed, and basically impossible that they're storing it salted. What could possibly go wrong?
- raldi 14y agoYou don't need unhashed password storage to enforce similarity rules. Presumably, the user has to type in their current password when they set a new password. When processing that request, you have all the information you need to do the similarity check.
- petitmiam 14y agoWhat about the 7 passwords prior?
- charliesome 14y agoI believe the 7 passwords prior aren't checked for similarity, only equality.