Linked Questions

20
votes
2answers
5k views

Company can tell if new and old passwords are too similar. Is there a security problem? [duplicate]

I've spoken to an employee of a big international company in germany. He said, employees are warned if their new password is too similar to the old password. (e.g. if they change the password from ...
7
votes
3answers
2k views

Forgot your password: “New password must have a minimum of 4 characters different from the previous password” [duplicate]

This was found on a password reset feature of a government website, where you enter your username, then it takes you to a screen where you can enter a new password enter confirmation of new password ...
3
votes
0answers
283 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
3
votes
0answers
222 views

Checking whether a password is derived from previous passwords [duplicate]

Possible Duplicate: How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext? On a system I used several years ago ...
2
votes
0answers
76 views

Disallowing Similar Passwords [duplicate]

Upfront, I want to clarify that I am not a professional cryptographer, I am more curious about playing with the math and science behind it, and also want to improve my habits with my own personal and ...
182
votes
6answers
34k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
66
votes
6answers
14k views

How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?

I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case. When I sign on to my online banking account, I'm prompted ...
24
votes
3answers
4k views

Do servers store my previous passwords?

When I change my password on some web servers like email, cloud, and social networks and try to use my previous password, the server denies it with message "Don't use your previous passwords". Does ...
10
votes
8answers
4k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
6
votes
3answers
834 views

Similarity comparisons with hashed passwords possible?

At a company I worked at, I had to change my password every 90 days and I could only reuse a password after 8 iterations. This no-reusal included passwords being too similar to the old one, e.g. when ...
7
votes
2answers
2k views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
4
votes
3answers
442 views

How can a company tell if my password is similar to the previous 5 passwords?

Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem? Also closely related (but not a duplicate): How can a system enforce a ...
0
votes
3answers
1k views

Testing a password for similarity to previous hashes

This question is a follow-up to a comment by Tobias Kienzler to an answer to "What is the purpose of the “Password minimum age” setting?". Consider a password policy that new passwords cannot be ...
1
vote
4answers
184 views

Disallowing new password if it contains sequency of 4 characters present in 10 previously used passwords [duplicate]

I was forced to changed my password to an account (large institution) and it had a rule that the new password cannot contains a series of 4 consecutive characters that were in 10 previously used ...
4
votes
2answers
327 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...

15 30 50 per page