Linked Questions

7 votes
2 answers
4k views

How facebook knows my new password is too similar to my old password? [duplicate]

I am still very new to Information Security field and as far as I know, websites use hashing algorithm on user's passwords before storing it and they don't know the plain-text password of a user. ...
Riley Willow's user avatar
  • 1,139
942 votes
11 answers
325k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
AviD's user avatar
  • 73.3k
559 votes
3 answers
102k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
aMJay's user avatar
  • 3,675
58 votes
6 answers
14k views

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
Iszi's user avatar
  • 27.1k
35 votes
4 answers
10k views

Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
Hassan Saqib's user avatar
33 votes
4 answers
8k views

Does Facebook storing old passwords compromise security? [duplicate]

Facebook stores old password hashes (along with the old salt), such that if you try to log in with a previous password, Facebook tells you that you updated the password (and when). Nice user ...
dave's user avatar
  • 443
12 votes
7 answers
5k views

How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]

Let's say that in the password policy the password history is defined to remember the last 10 passwords. I understand password history exists so that if a password is recovered from a compromised ...
Stef Heylen's user avatar
  • 1,736
48 votes
1 answer
10k views

Facebook password lowercase and uppercase [duplicate]

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
Undefined's user avatar
  • 639
34 votes
2 answers
4k views

Why does Facebook bother comparing old and new passwords?

An answer to this question says Facebook generates a bunch of password guesses to see if they hash the same as a previous version of the password. Why bother? If a service forces every password to ...
Witness Protection ID 44583292's user avatar
22 votes
2 answers
7k views

Company can tell if new and old passwords are too similar. Is there a security problem? [duplicate]

I've spoken to an employee of a big international company in germany. He said, employees are warned if their new password is too similar to the old password. (e.g. if they change the password from ...
uuu's user avatar
  • 385
24 votes
3 answers
5k views

Do servers store my previous passwords?

When I change my password on some web servers like email, cloud, and social networks and try to use my previous password, the server denies it with message "Don't use your previous passwords". Does ...
sluge's user avatar
  • 1,085
11 votes
8 answers
6k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
Michael come lately's user avatar
10 votes
3 answers
7k views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
Snowburnt's user avatar
  • 203
4 votes
4 answers
3k views

How to tell if a site is securely storing passwords? [closed]

A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
grass-hopper's user avatar
12 votes
4 answers
1k views

Password security

I was requested at the login page of a website to first change my password. After typing in a new password, the web page told me the new password did not differ enough from the previous one. Does this ...
Robert's user avatar
  • 123

15 30 50 per page