4 ms·
They're not necessarily storing passwords in the clear (though the Texas Secretary of State does[1], so it wouldn't surprise me). For example, when updating a
by 88e282102ae2e5b 12y ago
They're not necessarily storing passwords in the clear (though the Texas Secretary of State does[1], so it wouldn't surprise me).
For example, when updating a password on Facebook, they check to see if your new password is similar to your previous one by creating several variants of the new password, hashing them, and seeing if the hash matches any of your old password hashes.
[1] http://plaintextoffenders.com/post/68152196480/sos-state-tx-us-government-website-businesses http://plaintextoffenders.com/post/68152196480/sos-state-tx-...
- Brandon0 12y agoDo you have a source on the Facebook statement? I would be interested in hearing how they create the variants.
- 88e282102ae2e5b 12y agoOstensibly this is from a FB engineer, in retrospect I realize I don't know how to verify that: http://security.stackexchange.com/questions/53481/does-facebook-store-plain-text-passwords#comment84577_53483 http://security.stackexchange.com/questions/53481/does-faceb...