4 ms·
Doesn't enforcing this require storing the password in cleartext somewhere, which is a much more dangerous concept to begin with?
by lytedev 1y ago
Doesn't enforcing this require storing the password in cleartext somewhere, which is a much more dangerous concept to begin with?
- eru 1y agoIn practice, that's probably how it's done. But in theory: no. Assume you keep the hashes of the last few passwords around. Then you can search in the 'neighbourhood' of the new password to check if any of this matches the old password's hash. By neighbourhood, I mean something like within a small edit-distance, where the kind of edits depend on what measure of similarity you want. If you only care about similarity to the last password (or care about that one specifically), then that's even easier: during the password change procedure you can have clear text access to both the old and the new passwords without storing them anywhere unhashed: because the user has just entered both passwords.
- apitman 1y agoWouldn't this be super slow if you're using a proper password hashing algorithm?
- eru 1y agoYes, if it takes one cpu second to hash a password, it'll take a while to try a few like this. You can do a quick check against the last password (which you have in clear, because it was just entered), though.
- sakesun 1y agoInteresting perspective. Wonder why so many SaaS service currently enforce this.
- Mtinie 1y agoCargo culting.
- medvezhenok 1y agoIt probably requires some sort of decreased security (if the password hash is truly slow & secure, it would be hard to enforce dissimilarity); but there might be other methods that leak less than cleartext (like salting and storing hashes of overlapping/separate n-grams from the previous password and checking for number of similar n-grams; etc). Or as another commenter suggested checking all passwords within edit distance 1 (though if you can do that, your password hashing algorithm is likely too fast).
- tbrownaw 1y agoSimilarly of new vs current password is simple enough by just requiring the current password as part of the password change call. Which is a good idea anyway so someone can't just walk up and change your password if you forget to lock things over lunch. Similarly vs older passwords is what would be an issue.
- tiltowait 1y ago> Similarly vs older passwords is what would be an issue. Which isn't unheard of, though it's been years since I've seen it.
- yardstick 1y agoNot if they ask for the current password at the same time. https://news.ycombinator.com/item?id=44265372 https://news.ycombinator.com/item?id=44265372