This question already has an answer here:
I've seen it mentioned a number of times here that an approach to preventing forced password changes from being changed to trivially similar passwords (eg,
mysecurepassword1 gets changed to
mysecurepassword2 and so on) is to hash multiple variations that can be later compared to. That can be done by looking for patterns and doing things like incrementing numbers, adding them, etc.
I'm curious what the implications of this is on security. These hashes would give more opportunity for a brute forcer, wouldn't they? They're essentially collisions. Although on the other hand, you'd expect that if someone is brute forcing, they'd probably try the varitions around a similar time, so it seems like it wouldn't necessarily save much brute forcing time. I'm also unsure how much even collisions would matter if the password is secure enough. Eg, if we have 10 variations hashed, that theoretically means that it would take 10x fewer attempts to brute force the password, right? But the scale of magnitude of time that is needed to brute force a secure password is often so large that even a 10-fold decrease is still an impractically large length of time.
So yeah, does hashing these variations significantly weaken security? Is it small enough that it doesn't matter (particularly compared to the benefits of avoiding similar password reuse)?