Linked Questions

22 votes
2 answers

Company can tell if new and old passwords are too similar. Is there a security problem? [duplicate]

I've spoken to an employee of a big international company in germany. He said, employees are warned if their new password is too similar to the old password. (e.g. if they change the password from ...
uuu's user avatar
  • 375
6 votes
3 answers

Forgot your password: "New password must have a minimum of 4 characters different from the previous password" [duplicate]

This was found on a password reset feature of a government website, where you enter your username, then it takes you to a screen where you can enter a new password enter confirmation of new password ...
Obversity's user avatar
  • 163
3 votes
0 answers

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
Torvero's user avatar
  • 173
3 votes
0 answers

Checking whether a password is derived from previous passwords [duplicate]

Possible Duplicate: How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext? On a system I used several years ago ...
Stephen Paulger's user avatar
2 votes
0 answers

Disallowing Similar Passwords [duplicate]

Upfront, I want to clarify that I am not a professional cryptographer, I am more curious about playing with the math and science behind it, and also want to improve my habits with my own personal and ...
Poisson Aerohead's user avatar
189 votes
6 answers

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
Michał Šrajer's user avatar
68 votes
6 answers

How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?

I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case. When I sign on to my online banking account, I'm prompted ...
alexmuller's user avatar
  • 1,061
24 votes
3 answers

Do servers store my previous passwords?

When I change my password on some web servers like email, cloud, and social networks and try to use my previous password, the server denies it with message "Don't use your previous passwords". Does ...
sluge's user avatar
  • 1,085
11 votes
8 answers

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
Michael come lately's user avatar
6 votes
3 answers

Similarity comparisons with hashed passwords possible?

At a company I worked at, I had to change my password every 90 days and I could only reuse a password after 8 iterations. This no-reusal included passwords being too similar to the old one, e.g. when ...
helm's user avatar
  • 446
5 votes
3 answers

How can a company tell if my password is similar to the previous 5 passwords?

Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem? Also closely related (but not a duplicate): How can a system enforce a ...
EJoshuaS - Stand with Ukraine's user avatar
7 votes
2 answers

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this ...
Iszi's user avatar
  • 27.1k
1 vote
3 answers

Testing a password for similarity to previous hashes

This question is a follow-up to a comment by Tobias Kienzler to an answer to "What is the purpose of the “Password minimum age” setting?". Consider a password policy that new passwords cannot be ...
Damian Yerrick's user avatar
1 vote
4 answers

Disallowing new password if it contains sequency of 4 characters present in 10 previously used passwords [duplicate]

I was forced to changed my password to an account (large institution) and it had a rule that the new password cannot contains a series of 4 consecutive characters that were in 10 previously used ...
Dennis's user avatar
  • 13
4 votes
2 answers

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing &...
Iszi's user avatar
  • 27.1k

15 30 50 per page