Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem?
Also closely related (but not a duplicate): How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
A particular company (I won't say which one) requires that my password not be similar to any of the previous 5 passwords.
According to the linked questions, when they check to see if your password is too similar to the previous one, they just force you to enter both the old and new password and compare them that way. I understand that, and there doesn't appear to be any security problem with that.
However, the company in question actually compares my password to the previous 5 passwords, none of which I enter. How might they be doing this? Should I take this as evidence that they're either storing my passwords in plaintext or that they're using a really weak hashing function, or is there a legitimate way that they could do that without potentially compromising my password?
The linked answer in the second linked question briefly alludes to this issue but doesn't really fully address how they might be doing this or how big of a security concern it is.