6

This question already has an answer here:

I am still very new to Information Security field and as far as I know, websites use hashing algorithm on user's passwords before storing it and they don't know the plain-text password of a user.

Today, I tried to change my Facebook password but I got this error,

enter image description here

Even I don't remember my old password so how could facebook know what was my old password ?

marked as duplicate by user45139, RoraΖ, schroeder Oct 4 '15 at 15:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

We do not know how exactly Facebook manages user passwords, however, we can imagine this scenario:

A new user logs into his Facebook account using the password: Password1. It is likely that, immediately, Facebook generates similar passwords such as: Passw0rd1. pAssword2, Passmord1 ...etc.

Facebook then stores their respective hashes (which are different, of course) so that if a user user types his password (after reset), the hash of the new password is compared to all these stored hashes: Facebook can tell you then if your new password is similar to the previous one or not.


EDIT:

Following @Philipp comment saying Facebook does not hash passwords, I want to share this information that I quoted from the official Facebook documentation (Keeping Passwords Secure):

We hash each password using our internal password hashing algorithm and the unique salt for that person. Since Facebook stores passwords securely as hashes, we can't simply compare a password directly to the database. We need to hash it first and compare the hashes.

  • 4
    but as far as I remember even if we change the single character in password, the entire hash is changed...isn't that true ? – Riley Willow Oct 4 '15 at 12:34
  • 2
    @Begueradj, but isn't it a bad security practice to store multiple hashes of user's similar password in your database ? wouldn't that make cracking password easier in case if your database is compromised ? – Riley Willow Oct 4 '15 at 13:01
  • 1
    maybe Facebook does it locally! I mean when you enter your password, the HTML page on your machine replaces some letters, hashes them and send the hashes. I think you should ask someone who is professional at HTML programming :/ – Emadeddin Oct 4 '15 at 13:02
  • 2
    HTML is not programming – Riley Willow Oct 4 '15 at 13:02
  • 1
    Web programming. whatever it is ... you got the point ! – Emadeddin Oct 4 '15 at 13:03
1

The technical details are given in brief but Facebook does use hashing with unique salts. The plain text passwords are hashed with undisclosed algorithm(as Facebook has not revealed it) and then prefixed or postfixed with unique salt and compare it. If it matches then the user gets the green light otherwise no. In case, of similar password, may be Facebook use pre-computed and predicted hashed passwords like replace a with @ or i with 1 or replacing alphabet/s with Upper or lower case. It's given here in brief.

Not the answer you're looking for? Browse other questions tagged or ask your own question.