When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
Both of the current answers have interesting parts and complete each others, here's why :
@curiousguy is true when he says :
And @alcor is true when he says :
The important point to remember here, is that, as previously stated, you change your password when you are told so or because yours has been known by someone else.
If I tell you my password is "password", and I tell you that now, I have changed it. Will you try all possibilities like "p4ssword", "passw0rd", etc etc etc? Of course no, because now it can be "google" !
From an external point of view (meaning without the database leaked), your only options are brute forcing (if the login system has been made correctly/securely). Brute forcing a password just by only knowing the old one gave you as much chances as not knowing the old password : you can try all variant of "password" but that is not guaranteed to be near that at all!
In case you have access to the database, (and supposing the database stores hashes of password, not plain text), you will face two completely different hashes for the almost same password which won't help you more.
It depends from the point of view, and if you are worried about someone who could rediscover your clear text password.
By the definition of Hashing (of a clear text password) small changes in the input should reflect big changes in the output.
Suppose your initial password is: mahoney78
Suppose you change the first letter, and make it capital: Mahoney78
As you can see, it's very very different.
So, to answer clearly your question: YES, it's absolutely ok to change just a character, or reverse it, because the network policies don't check these things (this check should be a problem).
|show 3 more comments|
Why do you change a password?
The issue with a small change is that given the current password, finding the new one is much easier.
|show 6 more comments|