Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008).

Where is password history stored?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

The historical password hashes are stored in the SAM along with your current one, so are certainly equally breakable.

I used to run password strength audits for large financials, and part of the output would be analysis of the number of individuals who reused passwords with just a change to the final digit (guess how large a percentage does it!) PWDump and John the Ripper zapped through them quite happily:-) In fact you could get some benefits from the password history that could help you break ones the brute forcer wouldn't get to easily.

To flush these historical hashes, you could try to set history to 0 in security settings and enforce a password change. That might do it, but I don't honestly know. In any case this totally defeats your password history policy if you're hoping to maintain one.

share|improve this answer

I can't find it now, but I've seen a proposal from academic researchers to Microsoft on how they could fix this. They have a crypto scheme to preserve current functionality (including password history policies, I think), but avoid the normal attacks on old passwords.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.