Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?

share|improve this question
1  
Yes, it should be different, otherwise the fact part of your old password is contained in the new password reduces the number of passwords that need to be tried ( if this fact is known ). – Ramhound Jul 25 '12 at 18:06

3 Answers

up vote 0 down vote accepted

Both of the current answers have interesting parts and complete each others, here's why :

@curiousguy is true when he says :

Why do you change a password?

because you were told to do so or to defend against someone who knows your current password.

And @alcor is true when he says :

Suppose your initial password is: mahoney78

Your sha1-hashed password is: 98d7a3b353d3cf5c374fbc0c14b7ed503c674a7d Suppose you change the first letter, and make it capital: Mahoney78

Your sha1-hashed password is: c13fee55c4f91c0c6dadda8e7a2751955408b602

As you can see, it's very very different.

The important point to remember here, is that, as previously stated, you change your password when you are told so or because yours has been known by someone else.

If I tell you my password is "password", and I tell you that now, I have changed it. Will you try all possibilities like "p4ssword", "passw0rd", etc etc etc? Of course no, because now it can be "google" !

From an external point of view (meaning without the database leaked), your only options are brute forcing (if the login system has been made correctly/securely). Brute forcing a password just by only knowing the old one gave you as much chances as not knowing the old password : you can try all variant of "password" but that is not guaranteed to be near that at all!

In case you have access to the database, (and supposing the database stores hashes of password, not plain text), you will face two completely different hashes for the almost same password which won't help you more.

share|improve this answer
up vote 4 down vote

Why do you change a password?

  • because you were told to do so;
  • to defend against someone who knows your current password.

The issue with a small change is that given the current password, finding the new one is much easier.

share|improve this answer
I'm told to do so – Celeritas Jul 25 '12 at 18:34
4  
The person who told you do change your password should have explained you the reason for this directive. It is more motivating, and for good security, following directives mechanically is often not sufficient, directives have to be following intelligently. – curiousguy Jul 25 '12 at 18:47
My computer told me I had to change the password in 11 days. So I'm wondering if I should start memorizing a completely new one. – Celeritas Jul 25 '12 at 18:53
1  
@Celeritas If your company has a (IMHO stupid) policy that your password must be rotated every N days "just because" and you have no reason to suspect your password compromised then you can make minor changes to your password to meet the requirement. This of course assumes your password is inherently strong, and remains so if you make only minor changes. (Do however bear in mind shoulder-surfing attacks. If lots of people see you type your password a radical change occasionally is a good idea :-) – voretaq7 Jul 25 '12 at 19:12
@Celeritas "My computer told me I had to change the password in 11 days." Giving you prior notice is a Good Thing. This is exactly what makes user experience better, and helps people come up with good passwords. "So I'm wondering if I should start memorizing a completely new one." Yes, you should start to imagine a new password that is both strong (high entropy) and easy for you to remember, and not trivially different from the old one. – curiousguy Jul 25 '12 at 19:23
show 6 more comments
up vote -2 down vote

It depends from the point of view, and if you are worried about someone who could rediscover your clear text password.

By the definition of Hashing (of a clear text password) small changes in the input should reflect big changes in the output.

Suppose your initial password is: mahoney78

  • Your sha1-hashed password is: 98d7a3b353d3cf5c374fbc0c14b7ed503c674a7d

Suppose you change the first letter, and make it capital: Mahoney78

  • Your sha1-hashed password is: c13fee55c4f91c0c6dadda8e7a2751955408b602

As you can see, it's very very different.

So, to answer clearly your question: YES, it's absolutely ok to change just a character, or reverse it, because the network policies don't check these things (this check should be a problem).

share|improve this answer
2  
Providing the password lost wasn't reversed to plain text. – Lucas Kauffman Jul 25 '12 at 18:20
1  
Ok, but Celeritas asked for facts about password and changing passwords. I gave him the facts about cryptoanalysis and reverse engineering, and I think they are the best answers about the question. – alcor Jul 25 '12 at 18:44
7  
He didn't ask how hashes change, he asked if it's important to change the password significantly or not. Your answer will give him a misleading sense of safety as it stands now. – Lucas Kauffman Jul 25 '12 at 19:04
2  
The "problem" with this answer is that it assumes that only the well hashed password would ever be leaked. If that's the case, then yes this answer is correct. Leaks from Yahoo and others however have shown that well hashed passwords are much too rare. Also, if they're using a poor hash, like MD5, then it's easily reversed via Rainbow Table. Salt is a critical deterrent to rainbow tables, but that's getting into more depth than is necessary for the Answer. TLDR: Your answer relies on too many assumptions to be considered correct security advice. – Chris S Jul 25 '12 at 19:21
@ChrisS "a poor hash, like MD5" MD5 is not a "poor hash" in this context; SHA-1 would be no better. It is not MD5 fault if admin didn't use a salt. And rainbow tables are only useful when the passwords don't have high entropy (but low entropy passwords is the most common case). – curiousguy Jul 28 '12 at 15:15
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.