4 ms·
You don't need unhashed password storage to enforce similarity rules. Presumably, the user has to type in their current password when they set a new password.
by raldi 14y ago
You don't need unhashed password storage to enforce similarity rules. Presumably, the user has to type in their current password when they set a new password. When processing that request, you have all the information you need to do the similarity check.
- petitmiam 14y agoWhat about the 7 passwords prior?
- charliesome 14y agoI believe the 7 passwords prior aren't checked for similarity, only equality.