5 ms·
I’ve personally experienced the password change require that “more than X characters be different than the old password”
by repeekad 1y ago
I’ve personally experienced the password change require that “more than X characters be different than the old password”
- valleyer 1y agoUm, that's a really bad sign...
- klysm 1y agoTo elaborate for the uninitiated, that means they are storing it in plaintext somewhere.
- mx_03 1y agoIs there any way to check that with non-plain-text password?
- jchw 1y agoActually it can be trivial as long as you can require the user to re-type the current password when entering a new password; check hash first, then check edit distance with the entered "current password" (and, of course, promptly throw it away once you know the edit distance.)
- nullify88 1y agoOhh. I guess that's what Windows does when a user wants to change their own password in the domain.
- mrspuratic 1y agoIt does more than that, it keeps a hashed password history (which used to be in the user attr ntPasswdHistory, but is now "somewhere secret" afaik) according to the value of ms-DS-Password-History-Length attribute. OpenLDAP keeps these (ppolicy overlay) in the user object. So, it can hash any proposed password and compare the history to make it's not been seen $recently (as an exact match, since it's comparing hashes). It could also perform some minor permutations of any new password, and do the same history check to make sure you're not just changing the first or last character or digit. I don't know if it does this, but it could.
- _moof 1y agoUnless they ask you for your current password as part of the password change flow.
- mattmanser 1y agoNo it doesn't. Shows you how complicated all this is and how the un-initiated (including me) should learn to not give their two cents. When you do the password change it asks you for the old one, that's how it knows. So it asks for old + new, checks old is correct against the hash, and then compares old + new likeness. So it all happens in memory.
- rocqua 1y agoNo, you can do it safely. The idea is to have the password renewal process also ask for the previous password. This means the password changing method doesn't need to store a plaintext password, but still has access to the old plaintext password when changing. It's still not a great idea, but that's because nagging your users will see them choose worse passwords.
- _dark_matter_ 1y agoOh so trivially bypassable by changing your password twice.
- dspillett 1y agoNot if the check is done client-side, so the plain password never leaves you local domain. Of course the check being done client-side means that it isn't difficult to skip if you are inclined to make a smidgin of effort.
- thih9 1y agoIt can be done server side too, the old password can be sent along the new one and the server can verify it.
- dspillett 1y agoYes, what I meant to say that it doesn't even have to be done server-side, so the fact it happens doesn't imply the server ever sees the old password beyond it's initial setting.
- deleted 1y ago[deleted]