The security policy at my employer has a password rotation policy for my workstation. Upon a recent change of password I immediately received an email telling me of an issue:
According to our records, you recently changed your workstation password, which is synchronized automatically with XYZ. However, this email is sent to inform you that your password could not be set in the system. The most common reason for failure is that the first three characters of a password cannot be identical...
Please change your password once again via the Password Center or Windows.
How annoying that I need to change my password once again. But more curiously, I was under the impression that policies like this one would be impossible if password hashing was in practice. Should the administrators of system XYZ know what the first three characters of my previous password are or is it indicative of bad practice?
first three characters of a password cannot be identical
I interpreted this as "...first three characters of a password cannot be identical to the previous". The email itself was riddled with spelling and grammatical errors (it even contained a stack trace) so I mentally went into interpretation mode and now I think I interpreted this line incorrectly. On reading again it's probably just making a suggestion. I won't go jumping down the throats of the IT Helpdesk just yet! Nevertheless I think this can be answered hypothetically as though it were referring to the previous password so I will leave the question as it stands. (Incidentally, I'd be interested in knowing why one might have a policy that forbids the first three characters from being identical.)
Password is changed via CTRL+ALT+DEL in Windows. Some synchronization with other internal systems (time-writing systems for example) must occur when this happens.